Clarify backchannel logout behavior

[michaelstingl]

Clarify backchannel logout behavior: when a user logs out from one browser or device, all other active web sessions for that user are also logged out.

The current docs say "ensures that all sessions are properly terminated" which, combined with Backchannel Logout Session Required: true, could be read as per-session logout. Per the OIDC Backchannel Logout spec (Section 2.4), session_required: true means the sid claim is included in the logout token, identifying a specific session.

In practice, the backchannel logout handler correctly invalidates only the specific session by sid, but the SSE notification that follows broadcasts to all connected clients of that user (clientlog service), causing all web sessions to log out.

Tested on demo.opencloud.eu: logout in Safari logs out the same user in Chromium.

[Copilot]

Pull request overview

Updates the Keycloak integration documentation to explicitly describe OpenCloud’s observed backchannel logout behavior, clarifying that a logout from one client results in logout across the user’s other active web sessions.

Changes:

• Rewords the Backchannel Logout section to avoid implying per-session-only termination.
• Adds a link to the OIDC Backchannel Logout specification.
• Adds a note stating that logging out on one browser/device logs out other active web sessions for the same user.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.