Support configurable post-logout redirect for SSO (Keycloak federated logout)

[divyanshbasys]

Describe your question

When using Keycloak (or another OIDC IdP), the “Sign out” button in Langfuse only clears the Langfuse session. The IdP session stays active, so the next sign-in skips the IdP login screen.

It would help to support a configurable URL to redirect to after sign-out (e.g. via an env var like AUTH_POST_LOGOUT_REDIRECT_URL or per-provider, e.g. AUTH_KEYCLOAK_LOGOUT_URL). When set, after clearing the Langfuse session the user would be redirected to that URL (e.g. the IdP’s logout endpoint with an appropriate post_logout_redirect_uri back to Langfuse). That would allow true single-click “Sign out” from the Langfuse UI that also ends the IdP session (federated logout).

Self-hosted, Keycloak, Auth.js.

Langfuse Cloud or Self-Hosted?

Self-Hosted

If Self-Hosted

No response

If Langfuse Cloud

No response

SDK and integration versions

No response

Pre-Submission Checklist

• I have checked for existing issues/discussions and consulted Langfuse AI.

[inkeep-ai-assistant[bot]]

Currently, Langfuse does not support a configurable post-logout redirect URL for federated logout with Keycloak or other OIDC providers. (1)

The available Keycloak configuration options are:

• AUTH_KEYCLOAK_CLIENT_ID
• AUTH_KEYCLOAK_CLIENT_SECRET
• AUTH_KEYCLOAK_ISSUER
• AUTH_KEYCLOAK_SCOPE (defaults to "openid email profile")
• AUTH_KEYCLOAK_ID_TOKEN (defaults to true)
• AUTH_KEYCLOAK_ALLOW_ACCOUNT_LINKING (1)

There is no AUTH_POST_LOGOUT_REDIRECT_URL or AUTH_KEYCLOAK_LOGOUT_URL environment variable documented. (1)

Langfuse uses Auth.js (NextAuth.js) for authentication, which does integrate with many providers. (1) If you need this feature, you can add a feature request on GitHub at the Langfuse Ideas page. (1)

Check out these potentially useful resources:

• Authentication and SSO (self-hosted)
• Keycloak Login gets empty body discussion
• Custom email claim with keycloak discussion

📚 Sources:

1. Authentication and SSO (self-hosted)

---

Have another question? Just tag @inkeep.

[jannikmaierhoefer]

Thanks for adding this @divyanshbasys. I'll turn this post into an "ideas" post so we have this on our roadmap.