Weird export/re-import behaviour regarding post.logout.redirect.uris

Closes #14884

services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java

@@ -358,10 +358,7 @@ public class OIDCAdvancedConfigWrapper extends AbstractClientConfigWrapper {
 
     public List<String> getPostLogoutRedirectUris() {
         List<String> postLogoutRedirectUris = getAttributeMultivalued(OIDCConfigAttributes.POST_LOGOUT_REDIRECT_URIS);
-        if(postLogoutRedirectUris == null || postLogoutRedirectUris.isEmpty()) {
+        if(postLogoutRedirectUris == null || postLogoutRedirectUris.isEmpty() || postLogoutRedirectUris.get(0).equals("+")) {
-            return null;
-        }
-        else if (postLogoutRedirectUris.get(0).equals("+")) {
             if(clientModel != null) {
                 return new ArrayList(clientModel.getRedirectUris());
             }
@@ -370,6 +367,9 @@ public class OIDCAdvancedConfigWrapper extends AbstractClientConfigWrapper {
             }
             return null;
         }
+        else if(postLogoutRedirectUris.get(0).equals("-")) {
+            return new ArrayList<String>();
+        }
         else {
             return postLogoutRedirectUris;
         }

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java

@@ -866,6 +866,22 @@ public class OIDCClientRegistrationTest extends AbstractClientRegistrationTest {
     public void testPostLogoutRedirectUriNull() throws Exception {
         OIDCClientRepresentation clientRep = createRep();
         OIDCClientRepresentation response = reg.oidc().create(clientRep);
-        assertNull(response.getPostLogoutRedirectUris());
+        assertEquals("http://redirect", response.getPostLogoutRedirectUris().get(0));
+    }
+
+    @Test
+    public void testPostLogoutRedirectUriEmpty() throws Exception {
+        OIDCClientRepresentation clientRep = createRep();
+        clientRep.setPostLogoutRedirectUris(new ArrayList<String>());
+        OIDCClientRepresentation response = reg.oidc().create(clientRep);
+        assertEquals("http://redirect", response.getPostLogoutRedirectUris().get(0));
+    }
+
+    @Test
+    public void testPostLogoutRedirectUriMinus() throws Exception {
+        OIDCClientRepresentation clientRep = createRep();
+        clientRep.setPostLogoutRedirectUris(Collections.singletonList("-"));
+        OIDCClientRepresentation response = reg.oidc().create(clientRep);
+        assertTrue(response.getPostLogoutRedirectUris().isEmpty());
     }
 }

themes/src/main/resources/theme/base/admin/messages/admin-messages_en.properties

@@ -381,7 +381,7 @@ root-url.tooltip=Root URL appended to relative URLs
 valid-redirect-uris=Valid Redirect URIs
 valid-redirect-uris.tooltip=Valid URI pattern a browser can redirect to after a successful login or logout. Simple wildcards are allowed such as 'http://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
 valid-post-logout-redirect-uris=Valid post logout redirect URIs
-valid-post-logout-redirect-uris.tooltip=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' will use the list of valid redirect uris. Simple wildcards are allowed such as 'http://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
+valid-post-logout-redirect-uris.tooltip=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' or an empty field will use the list of valid redirect uris. A value of '-' will not allow any post logout redirect uris. Simple wildcards are allowed such as 'http://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used.
 base-url.tooltip=Default URL to use when the auth server needs to redirect or link back to the client.
 admin-url=Admin URL
 admin-url.tooltip=URL to the admin interface of the client. Set this if the client supports the adapter REST API. This REST API allows the auth server to push revocation policies and other administrative tasks. Usually this is set to the base URL of the client.