jira keycloak slo error

[김민주]

Hello.

Currently, both keycloak and Jira are operating in http environments.

However, sso is done smoothly by linking keycloak and jira. However, problems arise in logout.

For example, if only one client is logged in and logged out, it works normally.

However, if you log in multiple clients (e.g., bitbucket, confluence) and log out of double bitbucket, it does not log out of jira and confluence. The reason is that the keycloak session is single logged out works well, but it doesn't log out because it has its own sessions of jira and confidence left. I want to solve this problem. Maybe because of http, the basic authentication method of Jira is not disabled either.

1. Keycloak's front channel logout function does not work with the latest browser either.(i think because of CSP)

2. Keycloak's back channel logout function does not work because it does not know the atlasian.xsrf. token or JSESSIONID of the jira itself.

*The connection of jira and keycloak used the plug-in of the Atlasian marketplace.

*jira version is 7.13.8 and my keycloak version is 25.0.2.

[Martin Runge]

Hi @김민주

Have you solved it in the meantime?

I would emphasize two key points here. The main problem is that Jira manages its own session tokens (JSESSIONID and atlassian.xsrf token) independently from Keycloak. As a result, when Keycloak's SLO (Single Logout) is triggered, Jira does not automatically terminate its session.

To enable back-channel logout, confirm that the Keycloak Jira plugin is set up to process logout tokens at its logout endpoint. Verify that your logout URL is correctly registered in Keycloak's client settings. The back-channel logout should send a POST request with a logout token to Jira's logout endpoint, although support for this may be limited in Jira 7.13.8.

Cheers, Martin