Logging out of OpenID Connect provider #6645

New Issue

GiteaMirror · 2025-11-02T07:02:18-06:00

GiteaMirror commented

2025-11-02 07:02:18 -06:00

Originally created by @flortsch on GitHub (Jan 6, 2021).

Description

If you login to Gitea using an OpenID Connect provider (e.g., Keycloak) and logout again, you are logged out of Gitea, but you are still logged in at your OpenID provider. Clicking at the OpenID login button at the Gitea page will automatically log you back into the same account. It should be possible to also log out at the OpenID provider. Keycloak, as an example, provides a logout endpoint where you can logout from the OpenID provider and redirect back to the application, which could be used by Gitea when logging out (e.g., https://your-keycloak.com/auth/realms/example-realm/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fyour-gitea.com%2F).

Related issue in past: #12374

Originally created by @flortsch on GitHub (Jan 6, 2021). ## Description If you login to Gitea using an OpenID Connect provider (e.g., Keycloak) and logout again, you are logged out of Gitea, but you are still logged in at your OpenID provider. Clicking at the OpenID login button at the Gitea page will automatically log you back into the same account. It should be possible to also log out at the OpenID provider. Keycloak, as an example, provides a logout endpoint where you can logout from the OpenID provider and redirect back to the application, which could be used by Gitea when logging out (e.g., https://your-keycloak.com/auth/realms/example-realm/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fyour-gitea.com%2F). Related issue in past: #12374

GiteaMirror added the type/proposal type/enhancement labels 2025-11-02 07:02:18 -06:00

GiteaMirror commented

2025-11-02 07:02:19 -06:00

@zeripath commented on GitHub (Jan 7, 2021):

I didn't realise that there were specs for this - but:

https://medium.com/@robert.broeckelmann/openid-connect-logout-eccc73df758f

https://curity.io/resources/architect/openid-connect/openid-connect-logout/
https://openid.net/specs/openid-connect-frontchannel-1_0.html
https://openid.net/specs/openid-connect-backchannel-1_0.html

may be helpful for implementation.

@zeripath commented on GitHub (Jan 7, 2021): I didn't realise that there were specs for this - but: https://medium.com/@robert.broeckelmann/openid-connect-logout-eccc73df758f https://curity.io/resources/architect/openid-connect/openid-connect-logout/ https://openid.net/specs/openid-connect-frontchannel-1_0.html https://openid.net/specs/openid-connect-backchannel-1_0.html may be helpful for implementation.

GiteaMirror commented

2025-11-02 07:02:19 -06:00

@Baitanik commented on GitHub (Mar 10, 2023):

Is There any plan when this issue will be fixed ?
Log out from gitea , actually does not log out from oidc provider ..

@Baitanik commented on GitHub (Mar 10, 2023): Is There any plan when this issue will be fixed ? Log out from gitea , actually does not log out from oidc provider ..

GiteaMirror commented

2025-11-02 07:02:19 -06:00

@kimdre commented on GitHub (Aug 24, 2023):

It would be nice to have this feature implemented. 👍

@kimdre commented on GitHub (Aug 24, 2023): It would be nice to have this feature implemented. 👍

GiteaMirror commented

2025-11-02 07:02:19 -06:00

@Adphi commented on GitHub (Nov 20, 2023):

Perhaps the simplest way to implement this is to use the RP Initiated Logout spec

@Adphi commented on GitHub (Nov 20, 2023): Perhaps the simplest way to implement this is to use the [RP Initiated Logout spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)

GiteaMirror commented

2025-11-02 07:02:20 -06:00

@qworkz11 commented on GitHub (Jan 5, 2024):

Hi,
is there a workaround in order to achieve a logout at the OIDC provider until this feature is implemented?

@qworkz11 commented on GitHub (Jan 5, 2024): Hi, is there a workaround in order to achieve a logout at the OIDC provider until this feature is implemented?

GiteaMirror commented

2025-11-02 07:02:20 -06:00

@helmut72 commented on GitHub (Feb 9, 2024):

Also miss this feature. And adding name field in Keycloak (my full name) to Gitea full name.

@helmut72 commented on GitHub (Feb 9, 2024): Also miss this feature. And adding `name` field in Keycloak (my full name) to Gitea `full name`.

GiteaMirror commented

2025-11-02 07:02:20 -06:00

@de-johannes commented on GitHub (Mar 5, 2024):

@qworkz11 A workaround which could work:

Change the data-url in

4fd9c56ed0/templates/base/head_navbar.tmpl (L188)

of your local gitea to

https://keycloak.example.com/realms/MYREALM/protocol/openid-connect/logout?post_logout_redirect_uri=https://myapp.example.com&client_id=myclient

EDIT - my fault: that does not work as the gitea cookies persist. perhaps it works with editing the logout handler 368743baf3/routers/web/events/events.go (L93)

with something like

	// Handle logout
	if event.Name == "logout" {
		if ctx.Session.ID() == event.Data {
			_, _ = (&eventsource.Event{
				Name: "logout",
				Data: "here",
			}).WriteTo(ctx.Resp)
			ctx.Resp.Flush()
			go unregister()
			auth.HandleSignOut(ctx)
			// Set post logout redirect single logout Keycloak-uri here
			keycloakLogoutURL := "https://keycloak.example.com/realms/MYREALM/protocol/openid-connect/logout?post_logout_redirect_uri=https://myapp.example.com&client_id=myclient"
			ctx.Redirect(keycloakLogoutURL)
			break loop
		}
		// Replace the event - we don't want to expose the session ID to the user
		event = &eventsource.Event{
			Name: "logout",
			Data: "elsewhere",
		}
	}

But i don't know how to edit this on a local machine.

@de-johannes commented on GitHub (Mar 5, 2024): @qworkz11 A workaround which could work: Change the data-url in https://github.com/go-gitea/gitea/blob/4fd9c56ed09b31e2f6164a5f534a31c6624d0478/templates/base/head_navbar.tmpl#L188 of your local gitea to https://keycloak.example.com/realms/MYREALM/protocol/openid-connect/logout?post_logout_redirect_uri=https://myapp.example.com&client_id=myclient **EDIT** - my fault: that does not work as the gitea cookies persist. perhaps it works with editing the logout handler https://github.com/go-gitea/gitea/blob/368743baf3d904f86b553a88718583906f571c87/routers/web/events/events.go#L93 with something like // Handle logout if event.Name == "logout" { if ctx.Session.ID() == event.Data { _, _ = (&eventsource.Event{ Name: "logout", Data: "here", }).WriteTo(ctx.Resp) ctx.Resp.Flush() go unregister() auth.HandleSignOut(ctx) // Set post logout redirect single logout Keycloak-uri here keycloakLogoutURL := "https://keycloak.example.com/realms/MYREALM/protocol/openid-connect/logout?post_logout_redirect_uri=https://myapp.example.com&client_id=myclient" ctx.Redirect(keycloakLogoutURL) break loop } // Replace the event - we don't want to expose the session ID to the user event = &eventsource.Event{ Name: "logout", Data: "elsewhere", } } But i don't know how to edit this on a local machine.

GiteaMirror commented

2025-11-02 07:02:20 -06:00

@jlehtoranta commented on GitHub (Mar 25, 2024):

I decided to enhance and polish my basic implementation, which I was using for private purposes. It actually took quite a bit of time, since the Gitea code wasn't as ready for this as I first thought. Also there are always quite many error cases and action paths to take care of when implementing SLO. I think the code should be on review level now, so any additional testing is appreciated. Please note that there's one database migration, so I don't recommend testing on production databases before the pull request gets merged.

@jlehtoranta commented on GitHub (Mar 25, 2024): I decided to enhance and polish my basic implementation, which I was using for private purposes. It actually took quite a bit of time, since the Gitea code wasn't as ready for this as I first thought. Also there are always quite many error cases and action paths to take care of when implementing SLO. I think the code should be on review level now, so any additional testing is appreciated. Please note that there's one database migration, so I don't recommend testing on production databases before the pull request gets merged.

GiteaMirror commented

2025-11-02 07:02:21 -06:00

@zincnan commented on GitHub (Oct 15, 2025):

When logging out of Gitea, it cannot synchronously log out of Keycloak, making it impossible to conveniently switch OpenID users. Has this issue been resolved? I have tried various solutions, but none of them work. Currently, I can only log out by manually accessing: http://mykeycloak/realms/myrealm/protocol/openid-connect/logout.

@zincnan commented on GitHub (Oct 15, 2025): When logging out of Gitea, it cannot synchronously log out of Keycloak, making it impossible to conveniently switch OpenID users. Has this issue been resolved? I have tried various solutions, but none of them work. Currently, I can only log out by manually accessing: http://mykeycloak/realms/myrealm/protocol/openid-connect/logout.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6645