outline/outline

Logout not working with ODIC and Authentik (or Keycloak)

Closed this issue · 3 comments

ksaadDE commented

In this case ODIC + Authentik or Keycloak is used. Which are both working according to the same principles.

I would expect after clicking on "logout" that I am not logged in anymore after page refresh. Sadly, Outline is unable to just delete the session.

The discussion related to it can be found here #3672

I consider it a bug, as there is a logout function that is not (properly) working (= not logging the user out and terminating the session).

For security such functionalities are essential, yet alone for compliance.

tommoor commented

Did you set the OIDC_LOGOUT_URI correctly? This has been available for a while

  • 👍1
  • ❤️1
  • 🚀1
ksaadDE commented

Did you set the OIDC_LOGOUT_URI correctly? This has been available for a while

Hey, thank you very much! I checked the config and found out I haven't set the env var (docker). My bad!

Though I was not sure either whether that env var works at all, because the issue #3672 does not give clear indications whether it got introduced or not. Maybe you could clarify that in the issue.

Furthermore there are issues with Authentik and Logout routes, but I found a way to make it happening. If anyone is interested, kindly refer to this discussion, where I documented that goauthentik/authentik#9737

Thank you very much! Great work!