Single Logout (SLO) does not work as expected between Keycloak and Grafana

jangaraj · May 14, 2025, 12:09pm

That’s Back-Channel Logout, which is not implemented in the Grafana.

Back channel OIDC logout

opened 08:05AM - 12 Mar 24 UTC

type/feature-request

Hello, lately RP initiated logout was iplemented in Grafana, which is great a…nd that you very much for that. What is still missing and I think is very important part of OIDC is backchannel logout: https://openid.net/specs/openid-connect-core-1_0.html#OpenID.BackChannel When offboarding a user for example, it would be nice to be able to logout user from SSO and the user would also be logged out from Grafana itself. Now we have to logout user separately, which kinda downgrades SSO usage. Other way I can think of would be that grafana checks if the user session in keycloak is still active and logout the user if its not. But thats not really a backchannel logout. Some software I've encountered handle it this way and it is good enough. But I havent found a way how to do this in Grafana either. Thank you very much.

Topic		Replies	Views
Grafana backchannel logout when connected to SSO or workaround Authentication	1	420	March 11, 2024
OAuth2/OpenID Sign Out (Grafana + Keycloak) Authentication	11	11116	April 12, 2019
Grafana API to logout keycloak authenticated user Authentication api , logout	0	695	December 9, 2022
Single signon does logout when OAuth is logged out	3	948	February 6, 2020
Generic oAuth + session time out Grafana	2	3098	August 29, 2018

Single Logout (SLO) does not work as expected between Keycloak and Grafana

Related topics