# Best practice to detect logout from identity provider?

**URL:** <https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589>\
**Category:** Getting advice\
**Tags:** authentication\
**Created:** [July 2, 2020, 12:21am UTC](https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589 "2020-07-02T00:21:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![constfilin-sgn](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@constfilin-sgn](https://forum.keycloak.org/u/constfilin-sgn)\
**Post date:** [July 2, 2020, 12:21am UTC](https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589/1 "2020-07-02T00:21:57Z")

</div>

I have the following setup of my application client:

```auto
AppClient <= OIDC => KeyCloak <= SAML2 => MSAzure

```

In other words, I authenticate the client with Keycloak, Keycloak redirect the authentication to MSAzure identity provider over SAML2.

Things work fine, the app can login to Keycloak and app can logout (the logout automatically initiates logout from MSAzure)

The question is what do i do when the user logs out of MSAzure - in this case MSAzure does SingleLogout from Keycloak over SAML2 (this works fine) and Keycloak logs the user out. The problem is that my application does not know about this logout.

What is the best practice to get the application to learn about the logout or session termination on Keycloak?

I tried _JavaScript adapter_, but it does not because the session cookie [invalidates on local logout only](http://forum.keycloak.org/t/login-status-iframe-not-updated-after-force-end-session/1906).

Should the application client periodically poll OIDC auth endpoint passing [prompt=none](https://www.keycloak.org/docs/latest/securing_apps/#_params_forwarding)?

Should the application server periodically poll userinfo endpoint?

What is the best practice here?

---

<div class="post-metadata">

**Author:** ![geoff-va](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/geoff-va/32/624_2.png) [@geoff-va](https://forum.keycloak.org/u/geoff-va)\
**Post date:** [July 2, 2020, 2:05am UTC](https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589/2 "2020-07-02T02:05:06Z")

</div>

I’ve been using the check-session endpoint in keycloak vía oidc session management. Spec is still in draft, but it’s been working pretty well so far.

[https://openid.net/specs/openid-connect-session-1\_0.html#RPiframe](https://openid.net/specs/openid-connect-session-1_0.html#RPiframe)

The idea is that instead of polling via a request you open an iframe from the RP to the OP and send messages via the postmessage interface. Then when the session state changes in keycloak you can either force a logout on Your client or silently try to reauth them.

Your oidc client will need to support this and you’ll have to add an invisible iframe to your pages, but the base idea is pretty easy to implement. The part i haven’t got down yet is the silent reauth - so I’m just logging the user out for now.

Anyway - maybe worth a look through! Hope it helps!

---

<div class="post-metadata">

**Author:** ![constfilin-sgn](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@constfilin-sgn](https://forum.keycloak.org/u/constfilin-sgn)\
**Post date:** [July 2, 2020, 5:01pm UTC](https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589/3 "2020-07-02T17:01:12Z")

</div>

I looked how _Keycloak JavaScript Adapter_ uses RP IFrame. It basically relies on the fact that another page in the application does a logout from Keycloak and this changes the value of `document.cookie` and that’s how PR frame detects the change. That exactly what it means that PR frame detects session state change on [local logouts only](http://forum.keycloak.org/t/login-status-iframe-not-updated-after-force-end-session/1906).

In case if the session state changes **remotely** on Keycloak server by means of SingleLogout from Identity provider, then PR IFRAME approach does not work.

I implemented a similar approach where instead of polling `document.cookie`, an PR IFRAME checks OIDC session status on Keycloak server by calling ODIC authorize endpoint and passing [prompt=none](https://www.keycloak.org/docs/latest/securing_apps/#_params_forwarding). The approach works fine but I’d like to avoid polling completely, if possible.

Any advice would be appreciated.

---

<div class="post-metadata">

**Author:** ![geoff-va](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/geoff-va/32/624_2.png) [@geoff-va](https://forum.keycloak.org/u/geoff-va)\
**Post date:** [July 2, 2020, 5:19pm UTC](https://forum.keycloak.org/t/best-practice-to-detect-logout-from-identity-provider/3589/4 "2020-07-02T17:19:52Z")

</div>

Ah, ok. I think this is similar to an issue I ran into as well - sorry if I misunderstood earlier.

This does work if the keycloak session expires naturally or the user hits the end session endpoint somewhere, but I found it did not work If I force logout the user from inside keycloak. Perhaps the same mechanism is working in your case of the remote logout.

I created a [post](https://issues.redhat.com/browse/KEYCLOAK-13671) about this sometime back on keycloak and they confirmed as such but didn’t offer any other alternative. I’m pretty new to keycloak so all out of ideas now ☹