React-native-app-auth: Logging in as different user fails

[tensor5]

Issue

My app stores tokens on the device after login, and does logout by clearing device storage. However when I try to login again as a different user, after entering the credentials in the browser instance I get the message

You are already authenticated as different user '[email protected]' in this session. Please logout first.

Clearing the browser cache solves the problem. Is there anything I'm missing to properly handle logout?

---

Environment

• Your Identity Provider: Keycloak
• Platform that you're experiencing the issue on: iOS and Android
• Are you using Expo? No

[sebleclerc]

react-native-app-auth exposes only the revoke function which calls the revocation endpoint. This endpoint remove the entry for the user inside the refresh token table. The problem here is that when you login, the identity provider saves some informations inside a cookie. That cookie can only be remove by the identity provider using a logout script. For example, IdentityServer opens a logout window which close right away to do this. I can't say for other provider but this kind of mechanism sure exists. That's why when you clear the cache, it is working because that cookie is cleared. This is all possible using a end_session_endpoint.

Now, RN app auth doesn't expose a logout function that would call this endpoint. It wasn't available in AppAuth iOS until 1.1.0 and not even available in AppAuth Android.

As per the revoke endpoint, RN app auth made a call directly using fetch to the identity provider without using AppAuth because it seems it's not available. Probably it would be something similar to be implemented for the end_session endpoint.

[tensor5]

Thanks! I have been trying using revoke(), and later found out that it's not implemented for Keycloak.
Posting to the end_session_endpoint works.

[expouic]

@tensor5 can you explain with more details

Posting to the end_session_endpoint works.

[imaginasean]

Had not attempted to do a direct POST to the end_session_endpoint. Was this
just a direct https call from JavaScript you are referring to?

On Thu, Dec 5, 2019, 12:47 PM Pouic [e-mail] wrote:

@tensor5 https://github.com/tensor5 can you explain with more details

Posting to the end_session_endpoint works.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/FormidableLabs/react-native-app-auth/issues/382?email_source=notifications&email_token=AAKC3FF2G6FBIBSV2O4DXTTQXE5CVA5CNFSM4IW2BRI2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGBRC5Y#issuecomment-562237815,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAKC3FGWDOKEMMK37CFV5NLQXE5CVANCNFSM4IW2BRIQ
.

[expouic]

I try to call end_session_endpoint of my keycloak and i have success to logout user.

http://keycloakhost:keycloakport/auth/realms/{realm}/.well-known/openid-configuration

Change {realm} with your realm configuration and you have the url to execute the fetch.

example:
http://keycloakhost:keycloakport/auth/realms/{realm}/protocol/openid-connect/logout?id_token_hint=your_keycloak_token

[tensor5]

Here is what I do

const body = new URLSearchParams({
      client_id: Config.CLIENT_ID,
      refresh_token
    }).toString()

fetch(`${Config.ISSUER}/.well-known/openid-configuration`)
  .then(res => res.json())
  .then(openidConfig => fetch(
    openidConfig.end_session_endpoint,
    {
        body,
        headers: {
            Authorization: `Bearer ${accessToken}`,
            'Content-Type': 'application/x-www-form-urlencoded'
        },
        method: 'POST'
    }
))

[imaginasean]

Thanks, Nicola, I will test my end session end point out when I have a
chance this week. The caveat, I think, is that this library uses the global
safari instance so if the user was also logged in to web mail (office 365)
this will likely log them out. I confirmed on my iOS device by bringing up
safari and navigating to the Microsoft online site and it knew who I was
after authenticating in the app. Thanks again for your help!

-Sean

On Sat, Dec 7, 2019, 10:08 PM Nicola Squartini [e-mail]
wrote:

Here is what I do

fetch(${Config.ISSUER}/.well-known/openid-configuration)
.then(res => res.json())
.then(openidConfig => fetch(
openidConfig.end_session_endpoint,
{
body,
headers: {
Authorization: Bearer ${accessToken},
'Content-Type': 'application/x-www-form-urlencoded'
},
method: 'POST'
}
))

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/FormidableLabs/react-native-app-auth/issues/382?email_source=notifications&email_token=AAKC3FDMPPE6C6DNDC35DN3QXRQKPA5CNFSM4IW2BRI2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGGUXSY#issuecomment-562908107,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAKC3FGSAHXXQVUIY5GNE4DQXRQKPANCNFSM4IW2BRIQ
.

[asiriPiyajanaka]

I try to call end_session_endpoint of my keycloak and i have success to logout user.

http://keycloakhost:keycloakport/auth/realms/{realm}/.well-known/openid-configuration

Change {realm} with your realm configuration and you have the url to execute the fetch.

example:
http://keycloakhost:keycloakport/auth/realms/{realm}/protocol/openid-connect/logout?id_token_hint=your_keycloak_token

This works for me.. thankz...

[Danushka50]

I try to call end_session_endpoint of my keycloak and i have success to logout user.

http://keycloakhost:keycloakport/auth/realms/{realm}/.well-known/openid-configuration

Change {realm} with your realm configuration and you have the url to execute the fetch.

example:
http://keycloakhost:keycloakport/auth/realms/{realm}/protocol/openid-connect/logout?id_token_hint=your_keycloak_token

Finally worked...Saved my day. Thank you....