fix keycloak post_logout_redirect_uri #7603
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
Feb 5, 2026 at 21:27 UTC
587973e8ce1a6096fc695ba9c3b4374b133a9523
2 files changed
+10
-9
docs/docs/meshcentral/openidConnectStrategy.md
+5
-2
@@ -284,9 +284,12 @@ There are many available options you can configure but most of them go unused. A
284
"description": "URI your IdP sends you after successful authorization. This must match what is listed with your IdP. (Default is https://[currentHost][currentPath]/auth-oidc-callback)"
285
},
286
"post_logout_redirect_uri": {
287
- "type": "string",
287
+ "type": [
288
+ "string",
289
+ "boolean"
290
+ ],
291
"format": "uri",
289
- "description": "URI for your IdP to send you after logging out of IdP via MeshCentral.",
292
+ "description": "URI for your IdP to send you after logging out of IdP via MeshCentral OR set to false to not send a post logout redirect_uri"
293
"default": "https:[currentHost][currentPath]/login"
294
},
295
"id_token_signed_response_alg": { "type": "string", "default": "RS256" },
webserver.js
+5
-7
@@ -874,7 +874,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
874
if (typeof domain.authstrategies.oidc.logouturl == 'string') {
875
logouturl = domain.authstrategies.oidc.logouturl;
876
} else if (typeof domain.authstrategies.oidc.issuer.end_session_endpoint == 'string' && typeof domain.authstrategies.oidc.client.post_logout_redirect_uri == 'string') {
877
- logouturl = domain.authstrategies.oidc.issuer.end_session_endpoint + '?post_logout_redirect_uri=' + domain.authstrategies.oidc.client.post_logout_redirect_uri;
877
+ logouturl = domain.authstrategies.oidc.issuer.end_session_endpoint + (domain.authstrategies.oidc.issuer.end_session_endpoint.indexOf('?') == -1 ? '?' : '&') + 'post_logout_redirect_uri=' + domain.authstrategies.oidc.client.post_logout_redirect_uri;
878
} else if (typeof domain.authstrategies.oidc.issuer.end_session_endpoint == 'string') {
879
logouturl = domain.authstrategies.oidc.issuer.end_session_endpoint;
880
}
@@ -8036,7 +8036,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
8036
if (!strategy.client.redirect_uri) {
8037
strategy.client.redirect_uri = origin + url + 'auth-oidc-callback';
8038
}
8039
- if (!strategy.client.post_logout_redirect_uri) {
8039
+ if (!strategy.client.post_logout_redirect_uri && strategy.client.post_logout_redirect_uri !== false) {
8040
strategy.client.post_logout_redirect_uri = origin + url + 'login';
8041
}
8042
@@ -8177,12 +8177,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
8177
user.groups = profile && obj.common.validateStrArray(profile[strategy.groups.claim], 1) ? profile[strategy.groups.claim] : null
8178
}
8179
8180
- // Setup end session enpoint if not already configured this requires an auth token
8180
+ // Setup end session endpoint
8181
try {
8182
- if (!strategy.issuer.end_session_endpoint) {
8183
- strategy.issuer.end_session_endpoint = strategy.obj.client.endSessionUrl({ 'id_token_hint': tokenset })
8184
- parent.authLog('oidcCallback', `OIDC: Discovered end_session_endpoint: ${strategy.issuer.end_session_endpoint}`);
8185
- }
8182
+ strategy.issuer.end_session_endpoint = strategy.obj.client.endSessionUrl({ 'id_token_hint': tokenset })
8183
+ parent.authLog('oidcCallback', `OIDC: Discovered end_session_endpoint: ${strategy.issuer.end_session_endpoint}`);
8184
} catch (err) {
8185
let error = new Error('OIDC: Discovering end_session_endpoint failed. Using Default.', { cause: err });
8186
strategy.issuer.end_session_endpoint = strategy.issuer.issuer + '/logout';