Keycloak: Fix for Oversized Logout URL and Package Update
This update addresses an issue where the logout redirect URL became excessively large, leading to failed logouts and HTTP 500 errors. When users belonged to a large number of groups, the ID token grew substantially (exceeding 8 KB) because the full group list was mapped into it. During the NetEye logout process, passing this oversized token in the redirect URL caused requests to exceed header and URL size limits enforced by web servers, reverse proxies, and firewalls.
To resolve this, the Keycloak configuration has been updated to exclude group membership claims from the ID token. Group memberships remain fully available in both the access token and the UserInfo endpoint, ensuring that NetEye authorization, module access (such as Icinga Web 2), and permissions continue to function seamlessly while keeping the logout redirect lightweight.
Overall, this fix ensures smooth and reliable session termination across NetEye instances, preventing firewall blocks and web server header termination issues.
List of updated packages
The following packages have been updated for NetEye 4.49:
keycloak,keycloak-autosetup, keycloak-configurator,keycloak-python to version 26.7.4_neteye1.46.2-1
Luca Tecchio
Software Developer - IT System & Service Management Solutions at Würth IT Italy
Author
Luca Tecchio
Software Developer - IT System & Service Management Solutions at Würth IT Italy
GLPI: Fix of the upgrade to NetEye 4.50 when custom GLPI plugins are installed During the upgrade to NetEye 4.50, NetEye moves the GLPI plugins that you installed manually out of the folder /usr/share/glpi/plugins. Before this fix, NetEye did not Read More
Tornado: Allow disabling forwarding of local system logs to Tornado By default, rsyslog on NetEye nodes forwards all logs it handles to the Tornado event engine. These include the system logs of the NetEye node itself, which can generate a Read More
Important: Elastic Stack security update Type/Severity NetEye Product Security has rated this update as having a High security impact. Topic Updates for the Elastic Stack packages are now available for NetEye 4. Security Fix for NetEye 4.50 9.5.5_neteye3.105.3-1 CVEs Elastic Read More
Important: Keycloak security update Type/Severity NetEye Product Security has rated this update as having a high security impact. Topic An update for the keycloak packages is now available for NetEye 4. Security Fix for NetEye 4.50: 26.8.0_neteye1.47.1-1 Summary This Keycloak update (version Read More
OIDC group synchronization with read-only LDAP federation Fixed an issue that occurred when OIDC group synchronization was enabled alongside a read-only LDAP federation. The OIDC mapper attempted to modify LDAP-managed group memberships, resulting in the error: Not possible to delete Read More
