oauth logout URL

[cheggerdev]

Ask a Question!

Hello,

I have configured portainer OAUTH (SP) with authentik (IdP).
I have put in the logout URL on the SP side and works great.
See https://integrations.goauthentik.io/hypervisors-orchestrators/portainer/ for details.

Question:
What is the logout URL to use in the IdP ?

[mg1986jp]

For Authentik as IdP with Portainer as SP, the logout URL you'd set on the Authentik side is typically Portainer's logout endpoint. Portainer doesn't have a dedicated OIDC/OAuth logout callback endpoint though — it just clears the local session.

If Authentik supports back-channel logout or front-channel logout, you'd point it to your Portainer URL plus /#!/auth/logout, something like:

https://portainer.example.com/#!/auth/logout

But honestly I'm not sure Portainer implements the OIDC front-channel logout spec properly. You might want to just set the "post-logout redirect URI" in Authentik to redirect back to your Portainer login page after Authentik clears its own session:

https://portainer.example.com

What exact field in Authentik are you trying to configure? There are a few different logout-related settings (post-logout redirect, backchannel logout URL, etc.) and they work differently.

[cheggerdev]

If Authentik supports back-channel logout or front-channel logout, you'd point it to your Portainer URL plus /#!/auth/logout, something like:

https://portainer.example.com/#!/auth/logout

Authentik supports both front-channel and back-channel logout, with back-channel recommended. See https://docs.goauthentik.io/add-secure-apps/providers/single-logout/ for details.

What exact field in Authentik are you trying to configure? There are a few different logout-related settings (post-logout redirect, backchannel logout URL, etc.) and they work differently.

Logout in the IdP. I put

https://portainer.example.com/#!/auth/logout

in as the back-channel logout URL and it works perfectly. Thank you for your help.