OIDC RP Authn logout propagation to OIDC RP

[Pierre SAGNE]

Perfect!

Thanks a lot. I'll look into this. If I have a way to store the id_token 
and fetch it on the logout page, I'll be able to call the logout 
endpoint with the required parameters.

I'll try to implement that.

Have a nice day

Pierre Sagne.

Le 10/11/2025 à 16:03, Philip Smart via users a écrit :

>>
>> Thank you for your answer.
>>
>> And yes, "only forward upstream logout" is what i want and what I have
>> implemented on another proxy i have implemented with shibboleth idp,
>> with a simple logout url on the upstream idp (without any parameter : in
>> fact it was a shibboleth idp local logout on the upstream server).
>>
>> So if the use case you describe is implemented someday it would totally
>> fulfill my need.
>>
>> But I guess for now, I may be forced to implement something on my side.
>>
>> Is the id_token from the OIDC authentication stored somewhere in
>> session, or do I have to intercept it and store it myself if I want to
>> reuse it for logout?
>
> Not by default, there is a hook that allows you to inject a function 
> to extract information from the profile context, which is then added 
> to the Subject’s private credentials. This feature was designed to 
> enable the access_token and refresh_token to be set on an 
> OAuth2AccessTokenPrincipal and passed out of the flow, but you should 
> also be able to extract the id_token using this method. (see [1]). You 
> can take a look at the example class [2] as a guide.
>
>
> Phil
>
> [1] 
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials 
> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials>
> [2] 
> https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java
>> And if I have to get it myself, what is the less ugly way to do it?
>>
>> Or is there just no safe way to do it?
>>
>> I may have some pressure on this one, because our partner doesn't find
>> it acceptable that we don't propagate logout.
>>
>> Thanks in advance.
>>
>> Pierre Sagne.
>
> Jisc is a registered charity (in England and Wales under charity 
> number 1149740; in Scotland under charity number SC053607) and a 
> company limited by guarantee registered in England under company 
> number 05747339, VAT number GB 197 0632 86. Jisc's registered office 
> is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
> limited by guarantee which is registered in England under company 
> number 02881024, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> For more details on how Jisc handles your data see our privacy notice 
> here: https://www.jisc.ac.uk/website/privacy-notice
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251110/b70d2aa4/attachment.htm>