OIDC RP Authn logout propagation to OIDC RP

[Philip Smart]

Thank you for your answer.

And yes, "only forward upstream logout" is what i want and what I have
implemented on another proxy i have implemented with shibboleth idp,
with a simple logout url on the upstream idp (without any parameter : in
fact it was a shibboleth idp local logout on the upstream server).

So if the use case you describe is implemented someday it would totally
fulfill my need.

But I guess for now, I may be forced to implement something on my side.

Is the id_token from the OIDC authentication stored somewhere in
session, or do I have to intercept it and store it myself if I want to
reuse it for logout?


Not by default, there is a hook that allows you to inject a function to extract information from the profile context, which is then added to the Subject’s private credentials. This feature was designed to enable the access_token and refresh_token to be set on an OAuth2AccessTokenPrincipal and passed out of the flow, but you should also be able to extract the id_token using this method. (see [1]). You can take a look at the example class [2] as a guide.

Phil

[1] https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials
[2] https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java


And if I have to get it myself, what is the less ugly way to do it?

Or is there just no safe way to do it?

I may have some pressure on this one, because our partner doesn't find
it acceptable that we don't propagate logout.

Thanks in advance.

Pierre Sagne.


Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251110/f5268763/attachment.htm>