upstream/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-06-08 00:04:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Mark user session for removal when the user bound to cannot be resolved

Browse source 
Closes #40398

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
This commit is contained in:
Pedro Igor 2025-07-10 15:37:18 -03:00 committed by GitHub
parent 173471a1c9
commit 88069cd5fb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/PersistentUserSessionProvider.java
View file

@ -585,6 +585,8 @@ public class PersistentUserSessionProvider implements UserSessionProvider, Sessi
user = session.users().getUserById(realm, entity.getUser());
if (user == null) {
// mark the user session for removal when the user bound to the session can not be resolved
removeUserSession(realm, wrap(realm, entity, offline, null));
return null;
}

4
services/src/main/java/org/keycloak/protocol/oidc/endpoints/LogoutEndpoint.java
View file

@ -411,6 +411,10 @@ public class LogoutEndpoint {
try {
userSession = session.sessions().getUserSession(realm, userSessionIdFromIdToken);
if (userSession == null) {
userSession = session.sessions().getOfflineUserSession(realm, userSessionIdFromIdToken);
}
if (userSession == null) {
event.event(EventType.LOGOUT);
event.error(Errors.SESSION_EXPIRED);