OIDC RP Authn logout propagation to OIDC RP

[Pierre SAGNE]

Hi,

We have a Shibboleth IdP configured as an OIDC proxy. More precisely : 
we have SAML SP partners and OIDC clients, and we delegate 
authentication to an OIDC OP.

Authentication works fine.

But the OIDC OP we delegate authentication to requires that when a 
service (SAML SP or OIDC client) calls the Shibboleth IdP logout, we 
propagate the logout to the OIDC OP end_session_endpoint.

And this end_session_endpoint follows the OIDC RP Initiated logout spec 
(https://openid.net/specs/openid-connect-rpinitiated-1_0.html), so the 
following parameters are mandatory :

* id_token_hint (which is "recommended" in the spec but mandatory in 
this particular implementation)

* state (optional in the spec, but again, mandatory for this OP)

* post_logout_redirect_uri (optional in the spec, but again, mandatory 
for this OP)

I have tried enabling :

idp.session.trackSPSessions=true

idp.session.secondaryServiceIndex=true

But it seems to trigger logout propagation only to SAML SPs and OIDC 
clients, but not to the upstream OIDC OP.

Is there something implemented that I can activate somewhere, to 
propagate the logout to the OIDC OP, or do I have to implement something 
myself?

On another environment, I have modified the logout page to do a post 
logout redirect to an OP which had a more simple logout endpoint (just a 
simple URL without any parameters), but to do that in this case, I would 
need to fetch the id_token delivered during the authentication phase 
(and store it into the session if it is not automatically done by the 
OIDC RP auth plugin).

Best regards,

-- 
Pierre Sagne.