Keycloak: Fix for Oversized Logout URL and Package Update
This update addresses an issue where the logout redirect URL became excessively large, leading to failed logouts and HTTP 500 errors. When users belonged to a large number of groups, the ID token grew substantially (exceeding 8 KB) because the full group list was mapped into it. During the NetEye logout process, passing this oversized token in the redirect URL caused requests to exceed header and URL size limits enforced by web servers, reverse proxies, and firewalls.
To resolve this, the Keycloak configuration has been updated to exclude group membership claims from the ID token. Group memberships remain fully available in both the access token and the UserInfo endpoint, ensuring that NetEye authorization, module access (such as Icinga Web 2), and permissions continue to function seamlessly while keeping the logout redirect lightweight.
Overall, this fix ensures smooth and reliable session termination across NetEye instances, preventing firewall blocks and web server header termination issues.
List of updated packages
The following packages have been updated for NetEye 4.49:
keycloak,keycloak-autosetup, keycloak-configurator,keycloak-python to version 26.7.4_neteye1.46.2-1
Luca Tecchio
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Author
Luca Tecchio
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Update of Elastic Stack to Version 9.5.6 Elastic Stack 9.5.6 is a maintenance release that brings a large set of stability, correctness and hardening fixes across Elasticsearch, Kibana, Fleet Server, Logstash, Elastic Agent, Beats, Elastic Observability, and Elastic Security. Elasticsearch Read More
Disclaimer: The security issues below do not yet have publicly disclosed CVE identifiers, so details regarding their severity, impact, and potential attack vectors are not fully available at this time. This post will be updated as soon as additional information Read More
Disclaimer: The security issues referenced below do not yet have publicly disclosed CVE identifiers, so they are referenced by GHSA ID. This post will be updated as soon as CVEs become available. Important: Icinga 2 security update Type/Severity NetEye Product Read More
Disclaimer: The CVEs referenced below have not yet been publicly disclosed, so details regarding their severity, impact, and potential attack vectors are not available at this time. This post will be updated as soon as additional information becomes publicly available. Read More
Asset Management: GLPI agent inventory submissions through satellites now work with the glpiinventory plugin On NetEye satellites, nginx proxies GLPI inventory submissions from agents to the GLPI instance running on the master. Until now, the proxy covered only one endpoint, Read More
