user logout not work with keycloak

[daniel-yellow]

hi
I installed openmeta with bare metal version and set security settings with keycloak.
Login works normally, but logout doesn't work.

my openmetadata.yaml config is below

database:
  # the name of the JDBC driver, mysql in our case
  driverClass: ${DB_DRIVER_CLASS:-com.mysql.cj.jdbc.Driver}
  # the username and password
  user: ${MYSQL_USER:-openmeta_user}
  password: ${MYSQL_USER_PASSWORD:-openmeta_password}
  # the JDBC URL; the database is called openmetadata_db
  url: jdbc:${DB_SCHEME:-mysql}://${MYSQL_HOST:-localhost}:${MYSQL_PORT:-3306}/${MYSQL_DATABASE:-openmetadata_db}?allowPublicKeyRetrieval=true&useSSL=${DB_USE_SSL:-false}&serverTimezone=UTC

migrationConfiguration:
  path: "./bootstrap/sql"

# Authorizer Configuration

authenticationConfiguration:
  provider: "custom-oidc"
  providerName: "keycloak(sb)"
  publicKeyUrls:
    - "http://localhost:8080/realms/data-sec/protocol/openid-connect/certs"
  authority: "http://localhost:8080/realms/data-sec"
  clientId: "data-sec-cli"
  callbackUrl: "http://localhost:8585/callback"
  jwtPrincipalClaims:
    - "preferred_username"


authorizerConfiguration:
  className: "org.openmetadata.catalog.security.DefaultAuthorizer"
  containerRequestFilter: "org.openmetadata.catalog.security.JwtFilter"
  adminPrincipals:
    - "admin"
  botPrincipals:
    - "bot"
  principalDomain: "metadata.org"
  enforcePrincipalDomain: false
  enableSecureSocketConnection: false

For keycloak configuration, refer to this configuration guide.

{
  "clientId": "data-sec-cli",
  "name": "data-sec-cli",
  "description": "data-sec-cli",
  "rootUrl": "",
  "adminUrl": "",
  "baseUrl": "",
  "surrogateAuthRequired": false,
  "enabled": true,
  "alwaysDisplayInConsole": false,
  "clientAuthenticatorType": "client-secret",
  "secret": "---",
  "redirectUris": [
    "http://localhost:8585/*"
  ],
  "webOrigins": [
    "*"
  ],
  "notBefore": 0,
  "bearerOnly": false,
  "consentRequired": false,
  "standardFlowEnabled": true,
  "implicitFlowEnabled": true,
  "directAccessGrantsEnabled": true,
  "serviceAccountsEnabled": true,
  "publicClient": false,
  "frontchannelLogout": true,
  "protocol": "openid-connect",
  "attributes": {
    "oidc.ciba.grant.enabled": "false",
    "client.secret.creation.time": "1661738745",
    "backchannel.logout.session.required": "true",
    "display.on.consent.screen": "false",
    "oauth2.device.authorization.grant.enabled": "false",
    "backchannel.logout.revoke.offline.tokens": "false"
  },
  "authenticationFlowBindingOverrides": {},
  "fullScopeAllowed": true,
  "nodeReRegistrationTimeout": -1,
  "protocolMappers": [
    {
      "name": "Client IP Address",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "clientAddress",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "clientAddress",
        "jsonType.label": "String"
      }
    },
    {
      "name": "Client ID",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "clientId",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "clientId",
        "jsonType.label": "String"
      }
    },
    {
      "name": "Client Host",
      "protocol": "openid-connect",
      "protocolMapper": "oidc-usersessionmodel-note-mapper",
      "consentRequired": false,
      "config": {
        "user.session.note": "clientHost",
        "id.token.claim": "true",
        "access.token.claim": "true",
        "claim.name": "clientHost",
        "jsonType.label": "String"
      }
    }
  ],
  "defaultClientScopes": [
    "web-origins",
    "acr",
    "profile",
    "roles",
    "email"
  ],
  "optionalClientScopes": [
    "address",
    "phone",
    "offline_access",
    "microprofile-jwt"
  ],
  "access": {
    "view": true,
    "configure": true,
    "manage": true
  }
}

Can I get some advice?

[vivekratnavel]

Hi @GeonWoo-Yellow,

I am unable to reproduce this issue. I followed the exact steps in the document here. Can you please explain what you mean by logout doesn't work and post any screen-shots of the error messages you are getting? Also please state the version of OpenMetadata you are trying out.

Screen.Recording.2022-09-12.at.8.29.16.PM.mov

[abhijeet0801]

Facing same error, Once you click logout button, then you come back to sign in page, now if you click sign in, then it will directly start the previous session, without asking for credentials

[vivekratnavel]

Hi @abhijeet0801, it is by design to not logout the user from the underlying session for convenience. If your IDP session is still active, you will automatically be authenticated as that user to OpenMetadata.

[daniel-yellow]

Hi @vivekratnavel
thank you for the reply.

Shouldn't an action be called to expire the user's session when the user clicks the logout button?
On the demo site, it works like that.

[pengfan8080]

My dear friends, can you teach me how to use keycloak to achieve mobile phone login, registration, verification and other operations? Can you provide detailed screenshots of keycloak configuration, or a small demo of mobile number verification