Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logout fails due to id_token_hint is missing #1443

Open
alep85 opened this issue Oct 7, 2024 · 0 comments
Open

Logout fails due to id_token_hint is missing #1443

alep85 opened this issue Oct 7, 2024 · 0 comments

Comments

@alep85
Copy link

alep85 commented Oct 7, 2024

Describe the bug
If the local machine’s clock is significantly out of sync with the Keycloak server's time (beyond the allowable clock skew), the oauth service interpret the token as expired and thrown the error Token has expired even though the token is valid, and end up with an infinite loop.
To address the loop issue, I catch the tryLogin error and invoke revokeTokenAndLogout(). This function revokes the authentication token and redirects the user to the postLogoutRedirectUri. However, Keycloak returns the error Missing parameters: id_token_hint because the logout uri is called with only the post_logout_redirect_uri parameter.

Expected behavior
The logout endpoint is called with post_logout_redirect_uri and id_token_hint

Desktop (please complete the following information):

  • OS: macOS Sonoma 14.6.1
  • Browser chrome
  • Version 129.0.6668.90 (Official Build) (arm64)
  • angular-oauth2-oidc version 15.0.1

Additional context
In case of Token has expired, the logOut method doesn't set the id_token_hint oauth-service.ts#L2553-L2555 since the id_token is not set into the storage.
Storing the id_token after receiving the token response oauth-service.ts#L1912 could ensure proper handling of the logout process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant