Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraBackchannelLogoutFailing

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

More than 10% of back-channel logout deliveries are failing.

Meaning

Over 30 minutes, more than the threshold (10%) of deliveries counted in nauthera_backchannel_logout_deliveries_total ended in something other than success, for 30 minutes. permanent means the relying party refused the logout token or its endpoint is not one that takes them (not retried); exhausted means retries ran out (three attempts, five seconds each, within 30 seconds per logout); dropped means the fanout was never started because the server was at its limit of concurrent fanouts or shutting down.

Impact

End users who signed out, or whose sessions an administrator ended, are still signed in at the relying parties that missed the logout token, until those applications' own sessions end. Security: a session meant to be revoked stays usable there.

Diagnosis

  1. Outcomes: sum by (outcome) (rate(nauthera_backchannel_logout_deliveries_total\{ job="<name>"\}[30m])).
  2. Which clients and why: kubectl -n <ns> logs deploy/<name> | jq 'select(.msg|startswith( "back-channel logout"))'. Each line has client_id, endpoint_host, status, attempts and cause, such as rp_rejected (a 400: issuer, audience, algorithm or clock skew), rp_misconfigured (a status like 404 or 401), rp_timeout, rp_unreachable, rp_tls_failed, host_not_global (the host resolves to a private address the server will not dial), egress_proxy_failed or notifier_saturated.
  3. The audit log records each delivery as oidc.logout.token.delivered.

Mitigation

  • One client failing (rp_rejected, rp_misconfigured, rp_tls_failed): give its owner the cause; they fix their endpoint or their logout token validation. Back-channel logout URIs are registered through dynamic registration, so the client's owner updates it there.
  • host_not_global: the relying party is internal; the server refuses to dial non-global addresses, so it needs a publicly routable endpoint.
  • egress_proxy_failed: fix the proxy named in HTTPS_PROXY / HTTP_PROXY.
  • notifier_saturated or many exhausted: check whether many relying parties are slow at once and whether the server is overloaded.

Escalation

Tell the owners of the failing relying parties, and the security team if sensitive applications keep sessions after logout. If deliveries fail for endpoints that answer correctly to a hand-made test, open an issue with the log lines (they carry only the host, never the full URI) and the server version.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.