<p>When logged into gitlab using the oauth2 provider keycloak and trying to log out, Gitlab redirects to the sign_in page, but doesn't end out session on Keycloak, so we are logged in again.</p>
<p>These are the environment variables used in gitlab kubernetes deployment:</p>
<pre><code>- name: OAUTH2_GENERIC_APP_ID
  value: &lt;client-name&gt;
- name: OAUTH2_GENERIC_APP_SECRET
  value: &quot;&lt;client-secret&gt;&quot;
- name: OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL
  value: &quot;https://&lt;keycloak-url&gt;/auth/realms/&lt;realm-name&gt;/protocol/openid-connect/auth&quot;
- name: OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT
  value: &quot;https://&lt;keycloak-url&gt;/auth/realms/&lt;realm-name&gt;/protocol/openid-connect/logout&quot;
- name: OAUTH2_GENERIC_CLIENT_SITE
  value: &quot;https://&lt;keycloak-url&gt;/auth/realms/&lt;realm-name&gt;&quot;
- name: OAUTH2_GENERIC_CLIENT_TOKEN_URL
  value: &quot;https://&lt;keycloak-url&gt;/auth/realms/&lt;realm-name&gt;/protocol/openid-connect/token&quot;
- name: OAUTH2_GENERIC_CLIENT_USER_INFO_URL
  value: &quot;https://&lt;keycloak-url&gt;/auth/realms/&lt;realm-name&gt;/protocol/openid-connect/userinfo&quot;
- name: OAUTH2_GENERIC_ID_PATH
  value: sub
- name: OAUTH2_GENERIC_NAME
  value: Keycloak
- name: OAUTH2_GENERIC_USER_EMAIL
  value: email
- name: OAUTH2_GENERIC_USER_NAME
  value: preferred_username
- name: OAUTH2_GENERIC_USER_UID
  value: sub

- name: OAUTH_ALLOW_SSO
  value: Keycloak
- name: OAUTH_AUTO_LINK_LDAP_USER
  value: &quot;false&quot;
- name: OAUTH_AUTO_LINK_SAML_USER
  value: &quot;false&quot;
- name: OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
  value: Keycloak
- name: OAUTH_BLOCK_AUTO_CREATED_USERS
  value: &quot;false&quot;
- name: OAUTH_ENABLED
  value: &quot;true&quot;
- name: OAUTH_EXTERNAL_PROVIDERS
  value: Keycloak
</code></pre>
<p>I have tried a workaround mentioned here: <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/31203" rel="nofollow noreferrer">https://gitlab.com/gitlab-org/gitlab/-/issues/31203</a> , but no luck. Please help.</p>
<p>Note:</p>
<pre><code>Gitlab version: 14.9.2
Keycloak version: 17
Kubernetes Version: 1.21.5
</code></pre>

<p>To be perfectly clear: the expectation is that you should be signed out of GitLabn, not necessarily keycloak altogether. This is happening correctly since you see the sign-in page after signing out. For example, if you sign into GitLab using Google and sign out of GitLab, you should only be signed out of GitLab, not Google.</p>
<p>The behavior you are observing is due to the fact that you have auto-login <a href="https://docs.gitlab.com/ee/integration/omniauth.html#sign-in-with-a-provider-automatically" rel="nofollow noreferrer">(<code>auto_sign_in_with_provider</code>) enabled</a>, which automatically redirects users from the sign-in page to login again with keycloak (again) immediately after (successfully) signing out.</p>
<p>To avoid this problem, in the GitLab settings (under Admin -&gt; Settings -&gt; General -&gt; Sign-in Restrictions) set the <strong>After sign-out path</strong> to be <code>/users/sign_in?auto_sign_in=false</code> or in other words <code>https://gitlab.example.com/users/sign_in?auto_sign_in=false</code><br />
Note the query string <code>?auto_sign_in=false</code> will prevent the auto-redirect to sign back into keycloak. You can also choose a different URL entirely.</p>
<p>See <a href="https://docs.gitlab.com/ee/user/admin_area/settings/sign_in_restrictions.html#sign-in-information" rel="nofollow noreferrer">sign-in information</a> and <a href="https://docs.gitlab.com/ee/integration/omniauth.html#sign-in-with-a-provider-automatically" rel="nofollow noreferrer">sign in with provider automatically</a> for more information.</p>
