[java-oidc-common] branch main updated: JCOMOIDC-177 - Add LogoutHintClaim name setting to LogoutProfileConfig
Codeberg
noreply at shibboleth.net
Thu Jul 9 12:54:48 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
https://codeberg.org/Shibboleth/java-oidc-common/commit/b5e8879768d53b4fd30f35e44ee6686339afc3a6
The following commit(s) were added to refs/heads/main by this push:
new b5e88797 JCOMOIDC-177 - Add LogoutHintClaim name setting to LogoutProfileConfig
b5e88797 is described below
commit b5e8879768d53b4fd30f35e44ee6686339afc3a6
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Jul 9 13:54:39 2026 +0100
JCOMOIDC-177 - Add LogoutHintClaim name setting to LogoutProfileConfig
- Added logout hint claim name
https://shibboleth.atlassian.net/browse/JCOMOIDC-177
---
.../config/OIDCLogoutProfileConfiguration.java | 21 +++++++++++-
.../impl/DefaultOIDCLogoutConfiguration.java | 40 ++++++++++++++++++++++
...tLogoutRequestParameterValueMessageHandler.java | 2 +-
.../impl/AddPostLogoutRedirectURIHandler.java | 2 --
4 files changed, 61 insertions(+), 4 deletions(-)
diff --git a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
index 1cd0584e..b575af00 100644
--- a/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
+++ b/oidc-common-profile-api/src/main/java/net/shibboleth/oidc/profile/config/OIDCLogoutProfileConfiguration.java
@@ -117,7 +117,7 @@ public interface OIDCLogoutProfileConfiguration extends OAuth2TokenEncryptionPro
boolean isIgnoreInvalidPostLogoutRedirectUri(@Nullable final ProfileRequestContext profileRequestContext);
/**
- * Get the HTTP request method for a logout request.
+ * Get the HTTP request method for an RP-Initiated logout request.
*
* @param profileRequestContext profile request context
*
@@ -132,5 +132,24 @@ public interface OIDCLogoutProfileConfiguration extends OAuth2TokenEncryptionPro
@Nullable final ProfileRequestContext profileRequestContext) {
return HttpRequestMethod.GET;
}
+
+
+ /**
+ * Get the ID Token claim whose value should be used as the {@code logout_hint} parameter in an RP-Initiated
+ * Logout request.
+ *
+ * @param profileRequestContext profile request context
+ *
+ * @return the claim name, or {@code null} if no {@code logout_hint}
+ * should be supplied
+ *
+ * TODO: remove the default implementation in version 4.0.0
+ *
+ * @since 3.4.0
+ */
+ @ConfigurationSetting(name="logoutHintClaim")
+ @Nullable default String getLogoutHintClaim(@Nullable final ProfileRequestContext profileRequestContext) {
+ return null;
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
index c82be878..bd108005 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/config/impl/DefaultOIDCLogoutConfiguration.java
@@ -83,6 +83,12 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
/** Whether to ignore invalid post logout redirect URI in RP-initiated logout parameters. */
@Nonnull private Predicate<ProfileRequestContext> ignoreInvalidPostLogoutRedirectUriPredicate;
+
+ /**
+ * Lookup function to find the name of the claim from which to set the logout_hint. Typically the claim will be
+ * contained inside the ID Token.
+ */
+ @Nonnull private Function<ProfileRequestContext,String> logoutHintClaimLookupStrategy;
/**
* Constructor.
@@ -108,6 +114,7 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
customPostLogoutRedirectUriValidationStrategyLookupStrategy = FunctionSupport.constant(null);
ignoreInvalidPostLogoutRedirectUriPredicate = PredicateSupport.alwaysFalse();
httpRequestMethodLookupStrategy = FunctionSupport.constant(HttpRequestMethod.GET.toString());
+ logoutHintClaimLookupStrategy = FunctionSupport.constant(null);
}
@Override @Nullable @NotEmpty
@@ -370,5 +377,38 @@ public class DefaultOIDCLogoutConfiguration extends AbstractOAuth2InterceptorAwa
}
return null;
}
+
+ /**
+ * Set the lookup strategy to determine which claim (by name) should be extracted and set into the logout_hint
+ * parameter.
+ *
+ * @since 3.4.0
+ *
+ * @param strategy The strategy to set.
+ */
+ public void setLogoutHintClaimLookupStrategy(@Nonnull final
+ Function<ProfileRequestContext, String> strategy) {
+ logoutHintClaimLookupStrategy =
+ Constraint.isNotNull(strategy, "Logout hint claim strategy can not be null");
+ }
+
+ /**
+ * Set the name of the claim that should be extracted and set into the logout_hint parameter.
+ * parameter.
+ *
+ * @since 3.4.0
+ *
+ * @param name The claim name to set.
+ */
+ public void setLogoutHintClaim(@Nonnull @NotEmpty final String name) {
+ logoutHintClaimLookupStrategy = FunctionSupport.constant(
+ Constraint.isNotEmpty(name, "Logout hint claim name value should not be null or empty"));
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String getLogoutHintClaim(final ProfileRequestContext profileRequestContext) {
+ return logoutHintClaimLookupStrategy.apply(profileRequestContext);
+ }
}
\ No newline at end of file
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AbstractLogoutRequestParameterValueMessageHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AbstractLogoutRequestParameterValueMessageHandler.java
index a3094b44..742e48cb 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AbstractLogoutRequestParameterValueMessageHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AbstractLogoutRequestParameterValueMessageHandler.java
@@ -178,7 +178,7 @@ public abstract class AbstractLogoutRequestParameterValueMessageHandler<T> exten
checkSetterPreconditions();
logoutRequestLookupStrategy =
- Constraint.isNotNull(strategy, "LogoutContext lookup strategy cannot be null");
+ Constraint.isNotNull(strategy, "Logout request lookup strategy cannot be null");
}
@Override
diff --git a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddPostLogoutRedirectURIHandler.java b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddPostLogoutRedirectURIHandler.java
index 4c91b553..354fe6df 100644
--- a/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddPostLogoutRedirectURIHandler.java
+++ b/oidc-common-profile-impl/src/main/java/net/shibboleth/oidc/profile/messaging/handler/impl/AddPostLogoutRedirectURIHandler.java
@@ -49,7 +49,5 @@ public class AddPostLogoutRedirectURIHandler extends AbstractLogoutRequestParame
log.trace("{}: Set post_logout_redirect_uri to '{}'", getLogPrefix(), postRedirectUri);
}
-
-
}
\ No newline at end of file
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list