I have recognized the same thing:
- 2 applications (discourse and another one. lets name it X) connected to keycloak with SAML.
- Logout on discourse. The user is also logged out on X and can’t do anything there.
- Logout on X. The session on keycloak is gone but the user stays online in discourse
Even a browser page reload on discourse does not validate, that the saml auth is gone (= user is logged out).
I would expect that the user is logged out on discourse, too.
Does discourse check the saml auth on keycloak?
When will it do that?