# Logout at Spring Authorization Server doesn't terminate user session in Keycloak

**URL:** <https://forum.keycloak.org/t/logout-at-spring-authorization-server-doesnt-terminate-user-session-in-keycloak/18837>\
**Category:** Getting advice\
**Tags:** authentication, identity-brokering, oidc\
**Created:** [December 6, 2022, 7:50pm UTC](https://forum.keycloak.org/t/logout-at-spring-authorization-server-doesnt-terminate-user-session-in-keycloak/18837 "2022-12-06T19:50:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nehacharya04](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nehacharya04/32/7150_2.png) [@nehacharya04](https://forum.keycloak.org/u/nehacharya04)\
**Post date:** [December 6, 2022, 7:50pm UTC](https://forum.keycloak.org/t/logout-at-spring-authorization-server-doesnt-terminate-user-session-in-keycloak/18837/1 "2022-12-06T19:50:21Z")

</div>

Hi everyone,

I am trying to implement an **end-user initiated logout** mechanism.

I have 4 main entities involved.

- **Client:** an `Angular` app registered as a public `OIDC` client on `Keycloak`
- **Keycloak:** behaves as an identity broker
- **Spring Authorization Server:** identity provider registered on Keycloak
- **Resource Server:** a `Spring Boot` application with a secure `REST` endpoint

When the end-user initiates a `logout`, a call is made by the `Angular` application to Keycloak’s `end_session_endpoint`. I have configured the `logout` URL for my identity provider (Spring Authorization Server) in Keycloak as `http://localhost:9000/logout` which is the default `Spring Security` **logout** endpoint.

 ![Keycloak_config_for_external_idp](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/3/3a57b5d5bb5f6309c4001061f408bbd2fee00c1b.png)

In the `Network` tab of `Developer Console`, the sequence of calls happen as below:

- [http://127.0.0.1:8080/auth/realms/SpringBootKeycloak/protocol/openid-connect/logout?client\_id=hello-world&post\_logout\_redirect\_uri=http%3A%2F%2Flocalhost%3A4200%2F&id\_token\_hint=](http://127.0.0.1:8080/auth/realms/SpringBootKeycloak/protocol/openid-connect/logout?client_id=hello-world&post_logout_redirect_uri=http%3A%2F%2Flocalhost%3A4200%2F&id_token_hint=)

- [http://localhost:9000/logout?state=ff57bb5b-4a79-4e68-bd39-fe7a33ec8788&id\_token\_hint=...post\_logout\_redirect\_uri=http%3A%2F%2F127.0.0.1%3A8080%2Fauth%2Frealms%2FSpringBootKeycloak%2Fbroker%2Foidc%2Fendpoint%2Flogout\_response](http://localhost:9000/logout?state=ff57bb5b-4a79-4e68-bd39-fe7a33ec8788&id_token_hint=...post_logout_redirect_uri=http%3A%2F%2F127.0.0.1%3A8080%2Fauth%2Frealms%2FSpringBootKeycloak%2Fbroker%2Foidc%2Fendpoint%2Flogout_response)

While inspecting the `DEBUG` logs in the `Spring Authorization Server`, I am able to see the `logout` happen for that particular end-user including invalidating the `JSESSIONID`, however the **session doesn’t terminate in Keycloak** which causes the user to stay logged in and access the secure REST endpoint.

Is the `Spring Authorization Server` expected to **return a specific response** back to Keycloak to convey that the `logout` process is complete at it’s end and that Keycloak can end the session now?

This is my logic for `logout` at `Spring Authorization Server`.

```auto
@Bean
@Order(Ordered.LOWEST_PRECEDENCE)
public SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {

	http.csrf(csrf -> csrf.disable())
				.authorizeHttpRequests(
						authorize -> authorize.mvcMatchers("/redis/**").permitAll().anyRequest().authenticated())
				.formLogin(form -> form.loginPage("/login").permitAll())
				.addFilterAfter(cookieFilter, ChannelProcessingFilter.class)
				.logout().logoutSuccessUrl("http://localhost:4200");
		
	return http.build();
}

```

I am totally clueless about what I am missing to make Keycloak end the session at it’s end.  
Any leads will be greatly appreciated.  
Thank you!

---

<div class="post-metadata">

**Author:** ![nehacharya04](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nehacharya04/32/7150_2.png) [@nehacharya04](https://forum.keycloak.org/u/nehacharya04)\
**Post date:** [December 13, 2022, 5:21pm UTC](https://forum.keycloak.org/t/logout-at-spring-authorization-server-doesnt-terminate-user-session-in-keycloak/18837/2 "2022-12-13T17:21:58Z")

</div>

**Solution** to my problem: [Logout at Spring Authorization Server doesn’t terminate user session in Keycloak - Stack Overflow](https://stackoverflow.com/questions/74708420/logout-at-spring-authorization-server-doesn-t-terminate-user-session-in-keycloak)