The main problem on multi-node environment is keycloak sends a POST request to SLO endpoint of CAS but CAS won't ask username/password next time i.e. previous session is alive. What the best practice to solve such problem? We have tried to do a broadcast of POST request to SLO endpoint to all nodes of CAS environment but keycloak has had an exceptions related to java.net.SocketException: Connection reset. Maybe Hazelcast-Ticket Registry may help us?
*When there is only one keycloak and one CAS server* Everything works as expected: - Keycloak will send the sign out POST request to the only CAS server. - The only CAS server will then log user out, terminate the existing connection, and ask about username/password for new authentication requests. *When there are multiple CAS and keycloak servers* - User connects to keycloak server 1 (K1) with a persistent connection. - K1 redirects user to CAS server 1 (C1) for authentication. - User connects to C1 with a persistent connection and logs in. - C1 redirects the user to the keycloak VIP (K1 in this case, because of the persistent connection between user and K1). - C1 creates a connection to the keycloak VIP, sends some data, and then terminates the connection. - User click on the "Sign Out" button, and K1 logs user out. - Instead of redirecting user to CAS for a log out (which will put user on C1 due to the persistent connection between user and C1), K1 sends a POST request to the CAS VIP. - Because this is a new connection from K1 to CAS and there are multiple servers under the CAS VIP, K1 may connect to CAS server 2 (C2) and send the sign out POST request to that server. - At this time, user still has a persistent connection with C1. - When the user hit the CAS VIP again, the persistent connection between user and C1 is utilized. - C1 knows the user is already logged in hence it does not ask about username/password again. C1 then sends data to the keycloak VIP and redirects user to keycloak. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/749ddf53-52ba-4f72-afa7-6560d744c045%40apereo.org.
