Back channel logout: use mapper for logout token

1

Hi,

I am trying to use back channel logout to inform instances of my REST API when a user is signed out from the admin console (account lock for instance) so they can refuse the JWT issued for this user before the sign out.

But I declared a user property mapper in order to have the username in sub claim, so the logout token received by my APIs should also contains username for the sub claim. By default it is the keycloak userid. When I create the mapper there is no “Add to logout token” option.

Any idea ? Did I miss something ?

Thanks !

2

For logout tokens, there is no mapping supported.

In general, it’s not a good idea to map the username as the sub claim. The subject should be non-changing identifier of the user across its whole lifetime. The username might change. Better use the Keycloak ID as subject, so you also won’t get any problems with the logout token.