title: Keycloak Logout with SAML
body: <p>I got a problem with logout using saml protocol in Keycloak Server 4.2.1.
  Next to the Keycloak there is a Wildfly 9 server. In the Wildfly Server there 
  are serveral .war files deployed. They are JSF Applications with JEE7.</p>
  
  <p>I configured the saml adapter (keycloak-saml.xml) like this. Similiar to the documetation 
  (<a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#_saml-general-config" rel="nofollow noreferrer">https://www.keycloak.org/docs/latest/securing_apps/index.html#_saml-general-config</a>)</p>
  
  <pre><code>&lt;keycloak-saml-adapter&gt;
     &lt;SP entityID="amp"
        sslPolicy="EXTERNAL"
        logoutPage="logout.jsp"&gt;
        &lt;Keys&gt;
          &lt;Key signing="true"&gt;
              &lt;PrivateKeyPem&gt;
                  ...CLIENT PRIVATE KEY...
              &lt;/PrivateKeyPem&gt;
              &lt;CertificatePem&gt;
                  ...CLIENT CERTIFICATE ...
              &lt;/CertificatePem&gt;
          &lt;/Key&gt;
      &lt;/Keys&gt;
      &lt;PrincipalNameMapping policy="FROM_ATTRIBUTE"/&gt;
      &lt;IDP entityID="idp"
           signatureAlgorithm="RSA_SHA256"
           signatureCanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
          &lt;SingleSignOnService signRequest="true"
                               validateResponseSignature="true"
                               requestBinding="POST"
                               bindingUrl="http://localhost:8080/auth/realms/My-Realm/protocol/saml"/&gt;
          &lt;SingleLogoutService signRequest="true"
                               signResponse="true"
                               validateRequestSignature="true"
                               validateResponseSignature="true"
                               requestBinding="POST"
                               responseBinding="POST"
                               postBindingUrl="http://localhost:8080/auth/realms/My-Realm/protocol/saml"
                               redirectBindingUrl="http://localhost:8080/auth/realms/My-Realm/protocol/saml"/&gt;
          &lt;Keys&gt;
              &lt;Key signing="true"&gt;
                  &lt;CertificatePem&gt;
                      ... REALM CERTIFICATE ...
                  &lt;/CertificatePem&gt;
              &lt;/Key&gt;
          &lt;/Keys&gt;
      &lt;/IDP&gt;
  &lt;/SP&gt;
  &lt;/keycloak-saml-adapter&gt;
  </code></pre>
  
  <p>When i click the "logout button" the application calls
  the code below so that the Wildfly server invalidate the session.</p>
  
  <pre><code>((HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest()).logout();
  ((HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false)).invalidate();
  </code></pre>
  
  <p>I checked it and its working, the application is invalidate the session.</p>
  
  <p>Now after that, i have to tell the keycloak server that he should invalidate this session too.
  Which URL I have to call?</p>
  
  <pre><code> FacesContext.getCurrentInstance().getExternalContext().redirect(" ???? ");
  </code></pre>
  
  <p>Before I migrated to Keycloak Server 4.2.1, I had the older version 1.8.1 running.
  With the 1.8.1 Server I called the URL </p>
  
  <p>"<a href="http://localhost:8080/auth/realms/My-Realm/tokens/logout?redirect_uri=http://localhost:8180/amp" rel="nofollow noreferrer">http://localhost:8080/auth/realms/My-Realm/tokens/logout?redirect_uri=http://localhost:8180/amp</a>". </p>
  
  <p>But that is not working anymore. </p>
  
  <p>I have tested serveral URL but none of them are working. I checked the latest 
  documetation <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#logout-2" rel="nofollow noreferrer">https://www.keycloak.org/docs/latest/securing_apps/index.html#logout-2</a>
  and the parameter GLO=true is not working either.
  I also tried to configure "Logout Service POST Binding URL" and "Logout Service Redirect Binding URL" 
  for the client in the keycloak adminstration console.</p>
  
  <p>Did i miss something in code or adminstration console of keycloak? 
  Do i have to call a specific url in keycloak 4.2.1?</p>
  
  <p>If you need more informations, let me know.</p>
  
  <p>Thanks for your help.</p>
  
  <p>kind regards.</p>