OIDC RP Authn logout propagation to OIDC RP

[Pierre SAGNE]

Thank you for your answer.

And yes, "only forward upstream logout" is what i want and what I have 
implemented on another proxy i have implemented with shibboleth idp, 
with a simple logout url on the upstream idp (without any parameter : in 
fact it was a shibboleth idp local logout on the upstream server).

So if the use case you describe is implemented someday it would totally 
fulfill my need.

But I guess for now, I may be forced to implement something on my side.

Is the id_token from the OIDC authentication stored somewhere in 
session, or do I have to intercept it and store it myself if I want to 
reuse it for logout?

And if I have to get it myself, what is the less ugly way to do it?

Or is there just no safe way to do it?

I may have some pressure on this one, because our partner doesn't find 
it acceptable that we don't propagate logout.

Thanks in advance.

Pierre Sagne.

Le 07/11/2025 à 18:07, Scott Cantor a écrit :

> If I understand your use case, the proxying support has no logout support upstream at all.
>
> We have no firm plans for it, but if we do it, we'd have to either short-circuit the existing propagation out and *only* forward upstream, or it would be manual as a link on the final result page to do the final step. That would probably be more possible with OIDC than SAML because of the messaging involved, but "only send it upstream" has been the thought.
>
> -- Scott
>