Begin of the insertion**As** an administrator,
**I want** OpenProjectEnd of the insertion Begin of the deletion ### StepsEnd of the deletion to Begin of the insertionsupportEnd of the insertion Begin of the deletion reproduce

_Please write down the steps to reproduce. Try to write down all necessary preconditions (what permissions do you have, are other users involved?). Example:_

1. Have a keycloakEnd of the deletion OIDC Begin of the deletion integration with OpenProject withEnd of the deletion backchannel logout Begin of the insertionwith no session indicated byEnd of the insertion Begin of the deletion enabled
2. Log inEnd of the deletion the Begin of the insertionlogout token,
**so that** it's possible to implement a "logoutEnd of the insertion Begin of the deletion user multiple times in OpenProject (e.g., through two browsers)
3. Observe two sessions being shown in keycloak
4. Click "LogoutEnd of the deletion all sessions" Begin of the insertionfunctionality from an identity provider.End of the insertion Begin of the deletion for the given user in keycloakEnd of the deletion

### Begin of the insertionAcceptance criteria

This feature requestEnd of the insertion Begin of the deletion WhatEnd of the deletion is Begin of the insertionabout correct API/specification behaviour, so indicating "user facing" behaviour is hard.End of the insertion Begin of the deletion the buggy behavior?End of the deletion

Begin of the insertionAs of writing this ticket,End of the insertion Begin of the deletion _Please describeEnd of the deletion the Begin of the insertionfollowing observable behaviours should be true:End of the insertion Begin of the deletion bug with as most details as possible. Example:_End of the deletion

* Begin of the insertionWhen Keycloak's client setting "BackchannelEnd of the insertion Begin of the deletion Only one of the sessions will be invalidated, as theEnd of the deletion logout Begin of the insertionsession required" is setEnd of the insertion Begin of the deletion token mapsEnd of the deletion to Begin of the insertion**"On"**, OpenProject only logs out **a single session** whenEnd of the insertion Begin of the deletion one of the provided `SID` values that we storeEnd of the deletion a Begin of the insertionuser logs out from Keycloak

* When Keycloak's client setting "Backchannel logoutEnd of the insertion session Begin of the insertionrequired"End of the insertion Begin of the deletion for

### WhatEnd of the deletion is Begin of the insertionset to **"Off"**, OpenProject logs out **all sessions ofEnd of the insertion the Begin of the insertionuser** when a user logs out from Keycloak


###

###

###

### Technical notesEnd of the insertion Begin of the deletion expected behavior?End of the deletion

Begin of the insertion* The changesEnd of the insertion Begin of the deletion _Describe how the applicationEnd of the deletion should Begin of the insertionbe compatible to [https://openid.net/specs/openid-connect-backchannel-1\_0.html#LogoutToken](https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken)

* Logging out a user via backchannel logout **without** a session identifier (`sid`) should logout **all**End of the insertion Begin of the deletion behave like. Example:_

1. BothEnd of the deletion sessions Begin of the insertionof that user

* Logging out a user via backchannel logout **with** a session identifier (`sid`)End of the insertion should Begin of the insertionlogout **only** that session


End of the insertion Begin of the deletion be terminated as they are removed

End of the deletion ### Begin of the insertionRelated linksEnd of the insertion Begin of the deletion Additional informationEnd of the deletion

Keycloak Begin of the insertionis currently not capable of distinguishing between logging outEnd of the insertion Begin of the deletion only sendsEnd of the deletion a single Begin of the insertionsession or many sessions. This is documented in [https://github.com/keycloak/keycloak/issues/27359](https://github.com/keycloak/keycloak/issues/27359).End of the insertion Begin of the deletion backchannel logout request for one of the active SIDs. There appears to be no way of identifying whether multiple sessions are to be invalidatedEnd of the deletion