SSO problems and doubts

Configuring the server
1

I created a realm with two clients inside. The two clients are my webapp and Grafana. When I log in to my webapp and then open Grafana, I’m automatically logged into Grafana thanks to SSO. And so far, so good. The problem is that when I log out of my webapp and then return to Grafana, refreshing the Grafana web page, I remain logged in, even though the KC session has been properly closed. Is this mechanism correct?

Another problem: when I try to embed a web page from my webapp in a Grafana dashboard panel using an iframe, it redirects me to my webapp’s login page (unless I’ve logged in to my webapp first). However, I expected the page to open directly in the iframe, since I’m already logged into Grafana.

same domain:
.xyz Domain Names | Join Generation XYZ and .xyz Domain Names | Join Generation XYZ

2

another thing I noticed, that in chrome I don’t see cookies like: KEYCLOAK_IDENTITY and KEYCLOAK_SESSION, while if I use firefox I see them.

3

Keep things simple.
Forget about iframes and implement standard federation with OIDC using the Authorization Code flow with PKCE.
Then, for logout, there are several options depending on the user experience and the type of application you have.

  • OIDC RP-Initiated Logout [1]
  • OIDC Back-Channel Logout [2]

[1] Final: OpenID Connect RP-Initiated Logout 1.0
[2] Final: OpenID Connect Back-Channel Logout 1.0

4

I don’t like iframes either, but I have to use them. Is there a way to make sure the page opened in the iframe doesn’t ask for login?

5

The problem is that when I log out of my webapp and then return to Grafana, refreshing the Grafana web page, I remain logged in, even though the KC session has been properly closed. Is this mechanism correct?

Yes, this can be correct.

One thing to keep in mind: Keycloak controls the Keycloak session. The application controls its own session.

Grafana can keep its own login session using its own cookies or session state. So it is possible to log out of Keycloak, then refresh Grafana, and still appear logged in there.

To change that behavior, Grafana must explicitly handle logout. So the key question is not only “was the Keycloak session closed?” It is also “did Grafana clear its own session when that happened?”

I don’t like iframes either, but I have to use them. Is there a way to make sure the page opened in the iframe doesn’t ask for login?

I think you may struggle to get useful answers if you continue down the iframe path.

At that point, many of the problems are no longer really about Keycloak or even OIDC. They become browser and iframe behavior problems: third-party cookies, session isolation, silent auth restrictions, SameSite policies, CSP headers, browser privacy features, and cross-origin behavior.

That is also why people are recommending standard OIDC Authorization Code flow patterns instead. Those flows are well understood, broadly supported, and much easier to reason about.

If you must use iframes, you’ll likely need a fairly deep understanding of browser session behavior in addition to Keycloak and OIDC.