title: Keycloak Backchannel logout
body: <p>I was trying to understand the flow of a backchannel logout from my web application, but I find the documentation confusing. I have a JEE application running in JBoss EAP, with a <a href="https://www.keycloak.org/docs/3.2/securing_apps/topics/oidc/java/servlet-filter-adapter.html" rel="noreferrer">Java Servlet Filter Adapter</a> (for some technical reasons, I can't use the EAP adapter).  The <a href="https://www.keycloak.org/docs/3.2/securing_apps/topics/oidc/java/logout.html" rel="noreferrer">documentation for logging out</a> says:</p>
  
  <blockquote>
    <p>You can log out of a web application in multiple ways. For Java EE
    servlet containers, you can call HttpServletRequest.logout(). For
    other browser applications, you can redirect the browser to
    <a href="http://auth-server/auth/realms/" rel="noreferrer">http://auth-server/auth/realms/</a>{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri, which logs you out if you have an SSO session with your browser.</p>
  </blockquote>
  
  <p>The documentation for the <a href="https://www.keycloak.org/docs/3.4/securing_apps/#admin-url-configuration" rel="noreferrer">Admin URL configuration</a> says:</p>
  
  <blockquote>
    <p>For example the way backchannel logout works is:
    1. User sends logout request from one application
    2. The application sends logout request to Keycloak
    3. The Keycloak server invalidates the user session
    4. The Keycloak server then sends a backchannel request to application with an admin url that are associated with the session
    5. When an application receives the logout request it invalidates the corresponding HTTP session</p>
  </blockquote>
  
  <p>So from my understanding, either:</p>
  
  <ol>
  <li>calling HttpServletRequest.logout() is supposed to send a request to Keycloak</li>
  <li>a GET to  <code>http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri</code> should somehow detect the clientId (from the redirect URI?) and send a request to the appropriate backchannel</li>
  </ol>
  
  <p>Neither option seems to work for me.  In neither case, do I get a callback from Keycloak to my adminUrl.  Furthermore, I still see the same number of active sessions in my Keycloak Admin after calling Request.logout().  According to <a href="https://stackoverflow.com/q/49190827/827480">this SO post</a>, it seems to work, but I'm not sure if I am missing a configuration or something of the sorts.</p>
  
  <p>I've tried sending the GET to the logout endpoint with an access_token, but that doesn't make any difference either.</p>
  
  <p>What am I misunderstanding from this documentation?  How am I supposed to code the logout?</p>