I use LinkedIn as an IDP for a Keycloak realm with OpenIdConnect and this works fine even when I finally logout calling the endpoint /protocol/openid-connect/logout

As I specfied a “Backchannel logout URL” this url gets called as desired and I receive a logout_token. I delete the stored HttpSession afterwards.

But I also switched on “Backchannel logout revoke offline sessions” in Keycloak. There the tooltip says:

Specifying whether a “revoke_offline_access” event is included in the Logout Token when the Backchannel Logout URL is used. Keycloak will revoke offline sessions when receiving a Logout Token with this event.

In order to prompt this behaviour, I have not found much more documentation (there’s a paragraph about “Offline Access” here: https://www.keycloak.org/docs/latest/server_admin/index.html#%5C_offline-access).

So I checked Keycloak’s source code and found out that I have to POST to the endpoint /protocol/openid-connect/logout/backchannel-logout (in class org.keycloak.protocol.oidc.endpoints.LogoutEndpoint), which I did passing the logout_token as a parameter.

The problem now is that the logout_token was issued by keycloak, and so the issuer claim points to the uri of my Keycloak realm, whereas the validation of the logout_token in Keycloak class LogoutEndpoint asks for the uri http://www.linkedin.com/auth. If the issuer in the logout_token doesn’t match this url, the token is considered invalid which leads to the error message LogoutToken verification with identity provider failed.

Looking into LinkedIn I only found links for creating an access_token and an identity_token, but nothing about a logout_token. So I’m confused: how can the issuer be LinkedIn if it is Keycloak that issues the logout_token? Or should Keycloak get the logout_token somehow from LinkedIn? Or is there another way to make the /logout/backchannel-logout endpoint work properly?