DongHyeonkaandClaude Opus 5
6c310c93b7
Neither client had a backchannel logout URL and the BFF has no oidcLogout configuration, so the three candidate paths all answer 302, which is the authentication redirect rather than a handler. Setting the URL on the identity provider alone changed nothing: with a live session, logging the user out emptied the Keycloak side and left the Redis session untouched. Reachability is not the blocker here, since a Keycloak pod fetches the app's public URL with a 200, but that is a property of this tailnet split-DNS lab and is the assumption most likely to fail in production, where it fails silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
13 lines
459 B
Plaintext
13 lines
459 B
Plaintext
=== 현재 클라이언트의 백채널 로그아웃 설정 ===
|
|
--- bff-confidential ---
|
|
"frontchannelLogout" : false,
|
|
--- oauth2-proxy ---
|
|
"frontchannelLogout" : false,
|
|
|
|
=== BFF 가 백채널 로그아웃 엔드포인트를 갖고 있는가 ===
|
|
|
|
=== 실제로 그 경로가 있는가 ===
|
|
/logout/connect/back-channel/keycloak HTTP 302
|
|
/backchannel-logout HTTP 302
|
|
/oauth2/sign_out HTTP 302
|