Add support for Keycloak session revocation

Is your feature request related to a problem? Please describe. When using Alerta with an on-prem Keycloak, when a user clicks Log Out, he/she is presented with a You have been logged out message.

Clicking LOG IN again will log you on again with the same credentials, without being prompted for username / password.

It is possible in Keycloak to revoke a users session by calling a revocation-url.

https://www.keycloak.org/docs/4.8/securing_apps/index.html#logout-endpoint

Describe the solution you’d like Add an optional support for revocation of the Keycloak session when the user clicks the Log Out link.

This would truly log the user out, so that he/she can rest assured that he/she is truly logged out of the realm and that no unauthorized user who gains access to the desktop / browser can access services on the users behalf!

Describe alternatives you’ve considered A clear and concise description of any alternative solutions or features you’ve considered.

Additional context Add any other context or screenshots about the feature request here.

[satterly]

I’ve managed to get it working for Azure OIDC which used the browser cookies to determine which user to logout, but it failed with Okta which seems to want you to provide the original id_token. I’ve yet to test this with Keycloak.

[satterly]

Tested this with Keycloak now and it mostly works. The user session in Keycloak is revoked on logout from Alerta web UI but the browser is not redirected back to the “post_logout_redirect_url” so the user is just presented with a blank page. Not ideal but good enough for now.