From d7d9e75e5b4a0fc10e74522f3e419e7d76043023 Mon Sep 17 00:00:00 2001 From: Brandon Hopkins <76761586+TechHutTV@users.noreply.github.com> Date: Wed, 3 Jun 2026 07:42:33 -0700 Subject: [PATCH] Add optional logout URL step (#775) --- src/pages/selfhosted/identity-providers/adfs.mdx | 2 ++ src/pages/selfhosted/identity-providers/authentik.mdx | 1 + src/pages/selfhosted/identity-providers/generic-oidc.mdx | 5 +++++ src/pages/selfhosted/identity-providers/keycloak.mdx | 1 + src/pages/selfhosted/identity-providers/managed/auth0.mdx | 1 + src/pages/selfhosted/identity-providers/managed/duo.mdx | 4 ++++ .../identity-providers/managed/google-workspace.mdx | 5 +++++ .../selfhosted/identity-providers/managed/jumpcloud.mdx | 1 + .../identity-providers/managed/microsoft-entra-id.mdx | 1 + src/pages/selfhosted/identity-providers/managed/okta.mdx | 1 + src/pages/selfhosted/identity-providers/pocketid.mdx | 1 + src/pages/selfhosted/identity-providers/zitadel.mdx | 1 + 12 files changed, 24 insertions(+) diff --git a/src/pages/selfhosted/identity-providers/adfs.mdx b/src/pages/selfhosted/identity-providers/adfs.mdx index 846fb258..c85c3a7b 100644 --- a/src/pages/selfhosted/identity-providers/adfs.mdx +++ b/src/pages/selfhosted/identity-providers/adfs.mdx @@ -128,6 +128,8 @@ Write-Host "Client Secret: $($serverApp.ClientSecret)" Record both the **Client ID** and **Client Secret**. You will paste them into the NetBird dashboard in Step 2. +*(Optional)* To let logout redirect back to NetBird, register NetBird's logout callback as an additional redirect URI — include `"https:///oauth2/logout/callback"` in the `-RedirectUri` array above. ADFS validates the `post_logout_redirect_uri` against the registered redirect URIs. + ### 1.3 Add a Web API The Web API resource shares the same identifier as the Server Application so the permission grant in Step 1.4 binds them together. diff --git a/src/pages/selfhosted/identity-providers/authentik.mdx b/src/pages/selfhosted/identity-providers/authentik.mdx index 381337b1..4445c472 100644 --- a/src/pages/selfhosted/identity-providers/authentik.mdx +++ b/src/pages/selfhosted/identity-providers/authentik.mdx @@ -94,6 +94,7 @@ Add Authentik as an external IdP directly in the NetBird Management Dashboard. T

3. Under **Redirect URIs/Origins**, add the redirect URL you copied from NetBird + - *(Optional)* Add a second **Strict** entry, `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain), so logout redirects back to NetBird cleanly. Authentik validates post-logout redirects against this same allowlist. 4. Select **Strict** (not Regex) to match the exact URL from NetBird

diff --git a/src/pages/selfhosted/identity-providers/generic-oidc.mdx b/src/pages/selfhosted/identity-providers/generic-oidc.mdx index e54be994..4ef1f455 100644 --- a/src/pages/selfhosted/identity-providers/generic-oidc.mdx +++ b/src/pages/selfhosted/identity-providers/generic-oidc.mdx @@ -143,6 +143,11 @@ The redirect URL format is typically: https://your-netbird-domain.com/oauth2/callback/{connector-id} ``` +**(Optional) Logout redirect URI** — if your provider supports a post-logout (sign-out) redirect URI, also register NetBird's logout callback so logout redirects back to NetBird cleanly: +``` +https://your-netbird-domain.com/oauth2/logout/callback +``` + **Common issues:** Ensure the redirect URI matches exactly - no trailing slashes, correct protocol (https), and proper case sensitivity depending on your provider. diff --git a/src/pages/selfhosted/identity-providers/keycloak.mdx b/src/pages/selfhosted/identity-providers/keycloak.mdx index 24037846..481909c0 100644 --- a/src/pages/selfhosted/identity-providers/keycloak.mdx +++ b/src/pages/selfhosted/identity-providers/keycloak.mdx @@ -110,6 +110,7 @@ Add Keycloak as an external IdP directly in the NetBird Management Dashboard. Th 1. Return to the Keycloak Admin Console tab 2. On the Login settings page: - Under **Valid redirect URIs**, paste the redirect URL you copied from NetBird + - *(Optional)* Under **Valid post logout redirect URIs**, add `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain) so logout redirects back to NetBird cleanly 3. Click **Save** 4. Go to the **Credentials** tab and copy the **Client secret** — you'll need this for Step 6 diff --git a/src/pages/selfhosted/identity-providers/managed/auth0.mdx b/src/pages/selfhosted/identity-providers/managed/auth0.mdx index f51fe708..34afe039 100644 --- a/src/pages/selfhosted/identity-providers/managed/auth0.mdx +++ b/src/pages/selfhosted/identity-providers/managed/auth0.mdx @@ -55,6 +55,7 @@ Add Auth0 as an external IdP directly in the NetBird Management Dashboard. This 1. Return to the Auth0 tab 2. Go to **Settings** tab 3. Under **Allowed Callback URLs**, add the redirect URL you copied from NetBird + - *(Optional)* Under **Allowed Logout URLs**, add `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain) so logout redirects back to NetBird cleanly 4. Click **Save Changes**

diff --git a/src/pages/selfhosted/identity-providers/managed/duo.mdx b/src/pages/selfhosted/identity-providers/managed/duo.mdx index 843e95eb..be49c71a 100644 --- a/src/pages/selfhosted/identity-providers/managed/duo.mdx +++ b/src/pages/selfhosted/identity-providers/managed/duo.mdx @@ -78,6 +78,10 @@ Add Duo as an external IdP directly in the NetBird Management Dashboard. This is Configure Redirect URLs

+ +Duo SSO's generic OIDC relying party only exposes **Sign-In Redirect URLs** — there is no separate logout/sign-out redirect field, so no logout URL needs to be configured here. + + 4. Under **Scopes**, ensure the following are enabled: - **openid** (required, cannot be disabled) - **profile** (check the box) diff --git a/src/pages/selfhosted/identity-providers/managed/google-workspace.mdx b/src/pages/selfhosted/identity-providers/managed/google-workspace.mdx index 22d91ee7..8c0445e5 100644 --- a/src/pages/selfhosted/identity-providers/managed/google-workspace.mdx +++ b/src/pages/selfhosted/identity-providers/managed/google-workspace.mdx @@ -67,6 +67,11 @@ Add Google as an external IdP directly in the NetBird Management Dashboard. This

4. Click **Create** + + +Google's OAuth 2.0 client only supports **Authorized redirect URIs** — it has no separate logout/sign-out redirect field, so there is no logout URL to configure here. + + 5. Note the **Client ID** and **Client Secret** — you'll need these for Step 4

diff --git a/src/pages/selfhosted/identity-providers/managed/jumpcloud.mdx b/src/pages/selfhosted/identity-providers/managed/jumpcloud.mdx index 4e210b37..238f9114 100644 --- a/src/pages/selfhosted/identity-providers/managed/jumpcloud.mdx +++ b/src/pages/selfhosted/identity-providers/managed/jumpcloud.mdx @@ -83,6 +83,7 @@ Sometimes, the JumpCloud application configuration will add duplicate attributes 1. Return to the JumpCloud tab 2. Click the **SSO** tab 3. Under **Redirect URIs**, verify the redirect URL matches the exact URL you copied from NetBird (e.g., `https://netbird.hopkins.sh/oauth2/callback`). If it doesn't match exactly, update it to match. + - *(Optional)* In the **Post Logout Redirect URIs** field, add `https:///oauth2/logout/callback` (using the same domain as the redirect URL) so logout redirects back to NetBird cleanly 4. Click **Save** (if you made any changes)

diff --git a/src/pages/selfhosted/identity-providers/managed/microsoft-entra-id.mdx b/src/pages/selfhosted/identity-providers/managed/microsoft-entra-id.mdx index fb3ce993..9e399114 100644 --- a/src/pages/selfhosted/identity-providers/managed/microsoft-entra-id.mdx +++ b/src/pages/selfhosted/identity-providers/managed/microsoft-entra-id.mdx @@ -87,6 +87,7 @@ Add Microsoft as an external IdP directly in the NetBird Management Dashboard. C 2. Click **Add a platform** → **Web** 3. In the dropdown next to the redirect URI field, select **Web** 4. Paste the redirect URL you copied from NetBird in the **Redirect URI** field + - *(Optional)* Add NetBird's logout callback as an additional **Web** redirect URI: `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain). Entra validates the post-logout redirect against the registered redirect URIs, so this lets logout return to NetBird cleanly.

Select web and paste URI diff --git a/src/pages/selfhosted/identity-providers/managed/okta.mdx b/src/pages/selfhosted/identity-providers/managed/okta.mdx index 22b6c5ff..1c5ee5d0 100644 --- a/src/pages/selfhosted/identity-providers/managed/okta.mdx +++ b/src/pages/selfhosted/identity-providers/managed/okta.mdx @@ -72,6 +72,7 @@ Add Okta as an external IdP directly in the NetBird Management Dashboard. This i 1. Return to the Okta tab 2. In the **Sign-in redirect URIs** field, paste the redirect URL you copied from NetBird + - *(Optional)* In the **Sign-out redirect URIs** field, add `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain) so logout redirects back to NetBird cleanly

Sign-in redirect URIs diff --git a/src/pages/selfhosted/identity-providers/pocketid.mdx b/src/pages/selfhosted/identity-providers/pocketid.mdx index 54710914..8b1e7a8b 100644 --- a/src/pages/selfhosted/identity-providers/pocketid.mdx +++ b/src/pages/selfhosted/identity-providers/pocketid.mdx @@ -80,6 +80,7 @@ After saving, NetBird displays the **Redirect URL**. Copy this URL and add it to 1. Return to PocketID console → **OIDC Clients** 2. Edit your NetBird client 3. Add the redirect URL to **Callback URLs** + - *(Optional)* In **Logout Callback URLs**, add `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain) so logout redirects back to NetBird cleanly

Add callback URL diff --git a/src/pages/selfhosted/identity-providers/zitadel.mdx b/src/pages/selfhosted/identity-providers/zitadel.mdx index dcd3f593..ebf39e8e 100644 --- a/src/pages/selfhosted/identity-providers/zitadel.mdx +++ b/src/pages/selfhosted/identity-providers/zitadel.mdx @@ -87,6 +87,7 @@ Add Zitadel as an external IdP directly in the NetBird Management Dashboard. Thi 1. Return to the Zitadel Console tab 2. In the redirect URIs field, paste the redirect URL you copied from NetBird + - *(Optional)* In the **Post Logout URIs** field, add `https://netbird.example.com/oauth2/logout/callback` (replace `netbird.example.com` with your NetBird dashboard domain) so logout redirects back to NetBird cleanly

Add redirect URI