How to specify redirectUrl after logout for Ambassador OAuth2 Filter with Keycloak?

user_10776539 0
Viewed 760

I'm using the Ambassador OAuth2 Filter to perform OAuth2 authorization against Keycloak. For the logout I use the the RP-initiated logout as described in the Docs of Ambassador The logout works fine. However I could not figure out how to provide the redirect url needed for Keycloak to redirect to the Login page after successfully logged out. As a result the user stays on the blank logout page of keycloak.

The RP-initiated logout looks as follows

 const form = document.createElement('form');
    form.method = 'post';
    form.action = '/.ambassador/oauth2/logout?realm='+realm;
    const xsrfInput = document.createElement('input');
    xsrfInput.type = 'hidden';
    xsrfInput.name = '_xsrf';
    xsrfInput.value = getCookie("ambassador_xsrf."+realm);
    form.appendChild(xsrfInput);
    document.body.appendChild(form);
    form.submit();

I expected that Ambassador provides a way to add the redirect url as a query param or something, but I couldn't find a solution. Are there any suggestions or workarounds?

ambassador keycloak
2 Answers

I found this in the Ambassador documentation that could be overlooked as I did several times:

Ambassador OAuth2 Settings

protectedOrigins: (You determine these, and must register them with your identity provider) Identifies hostnames that can appropriately set cookies for the application. Only the scheme (https://) and authority (example.com:1234) parts are used; the path part of the URL is ignored.

You will need to register each origin in protectedOrigins as an authorized callback endpoint with your identity provider. The URL will look like {{ORIGIN}}/.ambassador/oauth2/redirection-endpoint.

So it looks like ambassador hard codes the redirection-endpoint (redirect_uri) that you need add to your OAuth2 client in Keycloak.

user_12725760

I found a solution for that, is not the best solution but you will logout using a button.

async function logout() {
const data = new URLSearchParams("realm=keycloak-oauth2-filter.ambassador")
data.append('_xsrf', getCookie("ambassador_xsrf.keycloak-oauth2-filter.ambassador"));
fetch('/.ambassador/oauth2/logout', {
  method: 'POST',
  body: data
})
  .then(function (response) {
    if (response.ok) {
      return response.text()
    } else {
      throw "err";
    }
  })
  .then(function (text) {
    console.log(text);
  })
  .catch(function (err) {
    console.log(err);
  });

}

user_94918870
Related