Keycloak 及其不同的适配器是否实现了 Openid Connect 反向通道注销规范

Question

Keycloak确实支持反向通道注销，但它是否符合Openid Connect反向通道注销草案规范？ https://openid.net/specs/openid-connect-backchannel-1_0.html

Answer 1

OpenID 连接反向通道注销是在 Keycloak 12.0 中实现的，该 Keycloak 于 2020 年 12 月发布。

早期版本仅实现了另一种专有机制。

Answer 2

这是Keycloak关于这个话题的Jira问题。去投票吧！

在浏览了规范和Keycloaks实现之后，我不得不说它不符合规范。例如，这是应从 OP 发送到 RP 的所需注销令牌格式的差异：

2.4. 注销令牌

OP 向 RP 发送类似于 ID 令牌的 JWT，称为注销令牌 请求他们注销。ID 令牌在 的第 2 节中定义 [OpenID.Core]。

注销令牌中使用以下声明：

iss
REQUIRED. Issuer Identifier, as specified in Section 2 of [OpenID.Core]. 
sub
OPTIONAL. Subject Identifier, as specified in Section 2 of [OpenID.Core]. 
aud
REQUIRED. Audience(s), as specified in Section 2 of [OpenID.Core]. 
iat
REQUIRED. Issued at time, as specified in Section 2 of [OpenID.Core]. 
jti
REQUIRED. Unique identifier for the token, as specified in Section 9 of [OpenID.Core]. 
events
REQUIRED. Claim whose value is a JSON object containing the member name http://schemas.openid.net/event/backchannel-logout. This declares that the JWT is a Logout Token. The corresponding member value MUST be a JSON object and SHOULD be the empty JSON object {}. 
sid
OPTIONAL. Session ID - String identifier for a Session. This represents a Session of a User Agent or device for a logged-in End-User at an RP. Different sid values are used to identify distinct sessions at an OP. The sid value need only be unique in the context of a particular issuer. Its contents are opaque to the RP. Its syntax is the same as an OAuth 2.0 Client Identifier. 

注销令牌必须包含 sub 或 sid 声明，并且可以 包含两者。如果 sid 声明不存在，则意图是所有 由国际空间站和潜艇标识的最终用户的RP会话 声明将被注销。

这是Keycloak在其当前版本(8.0.1(中发送的内容：

{
"id": "3536c4c4-fa51-4691-bc09-d229df83f774-1579360301277",
"expiration": 1579360331,
"resource": "resource-server-1",
"action": "LOGOUT",
"adapterSessionIds": [
"6569208C4937FD9C6E138C9DD9CF7C6F"
],
"notBefore": 0,
"keycloakSessionIds": [
"ca8060fd-48e9-4d26-b2d6-d6edb095f4b7"
]
}