OAuth Logout Not Working

Description:

I have a local instance of RocketChat and an identity provider (Keycloak) running on my machine. I have successfully configured OAuth between the two and I can login with a test user. The issue is when a user wants to logout of Rocketchat. When a user clicks the "Logout" button in the web UI, the application redirects the user to the RocketChat login screen, indicating a successful logout. However, when the user clicks the OAuth login button again, the user is logged in without getting prompted for credentials at all. This is because there is still an active user session on the identity provider side, and the identity provider is not aware of the logout attempt, nor did it ever logout the user.

As a comparison, I also have a local instance of Grafana running, which has OAuth set up in an identical way with the same Keycloak instance. Unlike RocketChat, Grafana has a setting to configure a URL for single logout, which redirects the user to the identity provider and the identity provider then takes care of logging the user out.
https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/keycloak/#enable-single-logout

Steps to reproduce:

1. Choose an OAuth identity provider of your choice. In this case, I used Keycloak.
2. In RocketChat settings, set up OAuth

• Login with an admin account
• Administration -> Workspace -> Settings -> OAuth -> Add custom OAuth
• I used the following settings for the OAuth setup:
  Enabled: true
  URL: https://keycloak
  Token Path: /realms/master/protocol/openid-connect/token
  Token Sent Via: Header
  Identity Token Sent Via: Header
  Identity Path: /realms/master/protocol/openid-connect/userinfo
  Authorize Path: /realms/master/protocol/openid-connect/auth
  Scope: openid
  Param Name for access token: access_token
  Id: rocketchat
  Secret:
  Login Style: Redirect
  Button Text: Login via Keycloak
  Key Field: Username
  Username Field:
  Email Field:
  Name Field:
  Avatar Field:
  Roles/Groups field name: roles
  Roles/Groups field for channel mapping: rocket.cat
  Map roles/groups to channels: false
  Merge roles from SSO: false
  Roles to sync:
  Merge users: false
  Merge users from distinct services: false
  Show button on login page: true

3. Navigate to the Rocketchat login page
4. Click "Login with Keycloak"
5. You will be redirected to Keycloak login page to enter your SSO credentials
6. Once logged in, log out
7. Once logged out, you will be redirected back to the login page
8. Click "Login with Keycloak" again and you will be logged in again without being prompted for credentials

Expected behavior:

There should be logout option in OAuth setup, something along the lines of "Logout Redirect URL", which should be used to redirect the user back to the identity provider for logging out when a user clicks "Logout" in Rocketchat.

Actual behavior:

Upon logout, user is redirected to the Rocketchat login screen. After clicking on "Login with Keycloak" button again, the user is logged straight in without being prompted for credentials.
(Short demo clip coming soon)

Server Setup Information:

• Version of Rocket.Chat Server: 6.3.9
• Operating System: MacOS 14.1
• Deployment Method: k8s
• Number of Running Instances: 1
• DB Replicaset Oplog: unknown (oplog Enabled)
• NodeJS Version: v14.21.3
• MongoDB Version: 6.0.5

Client Setup Information

• Desktop App or Browser Version:
• Operating System: MacOS 14.1

Additional context

Relevant logs:

Start with the OAuth settings and the web UI Logout button described in the report, then trace how the configured identity provider handles logout. Done means logging out redirects to the provider as configured and a subsequent OAuth login requires credentials when the provider session has ended.