Spring授权服务器（身份代理）联合身份提供商的登出实现问题

问题根源 #

你遇到的问题是默认的OidcLogoutEndpointFilter会优先拦截/connect/logout请求，当检测到id_token_hint参数时，直接执行重定向逻辑，但没有按预期先调用Keycloak的登出端点，也没正确联动本地会话清除流程。

解决步骤 #

1. 自定义登出成功处理器 #

编写自定义LogoutSuccessHandler，实现先请求Keycloak登出、再清除代理本地会话、最后重定向回React SPA的完整流程：

import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
import org.springframework.security.oauth2.core.oidc.OidcIdToken;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Optional;

public class CustomOidcLogoutHandler implements LogoutSuccessHandler {

    // 从Keycloak的OIDC元数据端点获取正确的end_session_endpoint
    private final String keycloakLogoutEndpoint = "https://你的Keycloak域名/realms/你的领域/protocol/openid-connect/logout";
    // React SPA的登出后回调地址，需提前在Keycloak客户端配置为有效URI
    private final String spaPostLogoutUri = "https://你的React域名/logout-success";

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        // 优先从请求参数取id_token_hint，也可从认证上下文获取
        String idTokenHint = Optional.ofNullable(request.getParameter("id_token_hint"))
                .orElseGet(() -> {
                    if (authentication instanceof OAuth2AuthenticationToken oauthToken) {
                        return oauthToken.getPrincipal().getAttribute(OidcIdToken.ID_TOKEN_VALUE);
                    }
                    return null;
                });

        if (idTokenHint != null) {
            // 构造Keycloak登出请求URL
            String logoutUrl = String.format(
                "%s?id_token_hint=%s&post_logout_redirect_uri=%s",
                keycloakLogoutEndpoint,
                idTokenHint,
                spaPostLogoutUri
            );
            // 重定向到Keycloak完成IDP端登出
            response.sendRedirect(logoutUrl);
        } else {
            // 无有效ID Token时直接跳回SPA
            response.sendRedirect(spaPostLogoutUri);
        }

        // 清除代理服务的本地会话
        request.getSession().invalidate();
    }
}

2. 配置Spring Security替换默认逻辑 #

在SecurityFilterChain中，替换默认的OidcLogoutEndpointFilter处理器，确保自定义逻辑生效：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.logout.LogoutFilter;
import org.springframework.security.oauth2.client.web.OidcLogoutEndpointFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/connect/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                // 保留你已有的登录配置
            )
            .logout(logout -> logout
                .logoutUrl("/connect/logout")
                .logoutSuccessHandler(new CustomOidcLogoutHandler())
                .invalidateHttpSession(true)
                .deleteCookies("JSESSIONID")
            )
            // 替换默认的OidcLogoutEndpointFilter，避免逻辑冲突
            .addFilterBefore(customOidcLogoutFilter(), LogoutFilter.class);

        return http.build();
    }

    @Bean
    public OidcLogoutEndpointFilter customOidcLogoutFilter() {
        OidcLogoutEndpointFilter filter = new OidcLogoutEndpointFilter();
        filter.setLogoutSuccessHandler(new CustomOidcLogoutHandler());
        return filter;
    }
}

3. 检查Keycloak客户端配置 #

• 开启Keycloak客户端的RP Initiated Logout选项
• 确认post_logout_redirect_uri已添加到客户端的Valid Post Logout Redirect URIs列表中
• 验证Keycloak的end_session_endpoint地址（可通过https://你的Keycloak域名/realms/你的领域/.well-known/openid-configuration获取）

验证流程 #

1. React SPA向代理的/connect/logout发送请求，携带id_token_hint和post_logout_redirect_uri参数
2. 代理的自定义处理器构造Keycloak登出URL并发起重定向
3. Keycloak完成自身会话清除后，重定向回指定的React SPA地址
4. 代理同时清除自身的本地会话，完成完整登出流程

内容的提问来源于stack exchange，提问作者Aravind Chan