Lion Cipher Lab

Log users out everywhere: OIDC RP-Initiated and Back-Channel Logout

• Identity & Access Management
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Logging a user in is the famous half of identity. Logging them out — cleanly, everywhere, on demand — is the half that shows up in incident response, in 'a shared kiosk still had someone's session', and in every audit that asks 'when an employee is fired, how fast does access actually stop?'. OpenID Connect does not have one logout; it has a family of them, and knowing which channel does what is the difference between thinking a user is signed out and actually ending their access. In this lab you run all of them by hand against a real Keycloak. You will perform RP-Initiated Logout: the app…

What you'll learn

• standing up Keycloak in Docker and configuring a confidential OIDC client with a valid post-logout redirect URI and a back-channel logout URL
• reading a realm's OIDC discovery document (/.well-known/openid-configuration) to find the end_session_endpoint instead of hard-coding it
• logging a user in with the authorization code flow to obtain an id_token and a real SSO session
• performing RP-Initiated Logout by calling the end_session_endpoint with id_token_hint and post_logout_redirect_uri
• explaining why id_token_hint matters — it prevents logout CSRF and stops the post-logout redirect from becoming an open redirect
• proving an SSO session is terminated with a prompt=none silent authorization request (a code comes back before logout, login_required after)
• distinguishing Front-Channel Logout (browser iframes to each RP's frontchannel_logout_uri) from Back-Channel Logout (a server-to-server logout_token POST)
• capturing and base64url-decoding a back-channel logout_token and reading its special events claim, sid, and sub
• knowing exactly what an RP must validate on a logout_token before it destroys a session
• terminating sessions from the Keycloak admin console — a single session and every session of a user

Steps in this lab

1. The words first: session vs token, and the three logout channels
2. Start a real authorization server: Keycloak in Docker
3. Run a tiny local listener to catch redirects and the back-channel POST
4. Create a realm, a confidential client, and a test user
5. Read the discovery document — find the real endpoint URLs
6. Log alice in (authorization code flow) and get an id_token
7. Confirm the session is ALIVE with a silent (prompt=none) request
8. RP-Initiated Logout: hit the end_session_endpoint
9. Front-Channel vs Back-Channel: how OTHER apps get told to log out
10. Trigger and DECODE a real back-channel logout_token
11. Admin-driven logout: end one session, or all of a user's sessions
12. The caveat that catches everyone: the access token still works
13. Judgment: which logout channel, and when

Open the full interactive lab →