OpenId Logout not terminating OIDC Session

Expected behavior

Click logout
Click login
Redirected to external application prompts for credentials (we are using keycloak)
Login

Actual behavior

Click logout
Click login
Redirected back to atlas instead of the external application login screen (because the session is still active in the external authorization application (keycloak))

Environment variables

# OAuth
SECURITY_OAUTH_CALLBACK_UI="https://.../atlas/#/welcome"
SECURITY_OAUTH_CALLBACK_API="https://.../WebAPI/user/oauth/callback?client_name=OidcClient"

# OpenID
SECURITY_AUTH_OPENID_ENABLED="true"
SECURITY_OID_CLIENTID="ohdsi"
SECURITY_OID_APISECRET="..."
SECURITY_OID_URL="https://.../auth/realms/CDEP/.well-known/openid-configuration"
SECURITY_OID_LOGOUTURL=
SECURITY_OID_EXTRASCOPES="roles"
SECURITY_OID_REDIRECTURL="https://.../atlas/#/welcome/null/"

We are hosting from docker using Broadsea

We are successfully hitting org.ohdsi.webapi.shiro.filters.LogoutFilter (confirmed with debug logs), but the filter isn't logging out the OIDC Client because the next attempt to login immediately results in a login (no prompt for credentials).

Start with org.ohdsi.webapi.shiro.filters.LogoutFilter and review how the OpenID settings, especially SECURITY_OID_LOGOUTURL, are used during logout. Reproduce the logout/login flow with Keycloak and confirm that the external OIDC session is terminated before login redirects back to the provider.