OIDC RP Authn logout propagation to OIDC RP

[Pierre SAGNE]

Hi,

I have made some progress.

I managed to save the id_token with the bean you mentioned, Philip.

I also managed to get it during attribute resolution by fetching the 
SubjectContext from the PRC, then the Subject, and my id_token with 
getPrivateCredentials().

Now, the problem I face is getting the id_token when I actually need it, 
which is in the logout.vm, where  I do my redirection to the other OIDC 
logout endpoint.

But I had no luck finding any Subject at this step (no more 
SubjectContext in PRC, I guess at this time it has already been destroyed).

Also no Subject following the path : logoutContext => IdPSessions => 
AuthenticationResults => Subject

Is there a way I can get a subject on the logout page or is it too late. 
And if it is too late, is there a way I can grab it earlier, within a 
hook and store it somewhere the logout.vm can get it in the end?

I'm experimenting at this point, but if there is an intended way to do 
this, I'd like to do it the right way (or at least in a way which will 
cause less problems later).

Thanks a lot.

Best regards,

Pierre Sagne.

Le 10/11/2025 à 16:07, Pierre SAGNE via users a écrit :
>
> Perfect!
>
> Thanks a lot. I'll look into this. If I have a way to store the 
> id_token and fetch it on the logout page, I'll be able to call the 
> logout endpoint with the required parameters.
>
> I'll try to implement that.
>
> Have a nice day
>
> Pierre Sagne.
>
> Le 10/11/2025 à 16:03, Philip Smart via users a écrit :
>>>
>>> Thank you for your answer.
>>>
>>> And yes, "only forward upstream logout" is what i want and what I have
>>> implemented on another proxy i have implemented with shibboleth idp,
>>> with a simple logout url on the upstream idp (without any parameter : in
>>> fact it was a shibboleth idp local logout on the upstream server).
>>>
>>> So if the use case you describe is implemented someday it would totally
>>> fulfill my need.
>>>
>>> But I guess for now, I may be forced to implement something on my side.
>>>
>>> Is the id_token from the OIDC authentication stored somewhere in
>>> session, or do I have to intercept it and store it myself if I want to
>>> reuse it for logout?
>>
>> Not by default, there is a hook that allows you to inject a function 
>> to extract information from the profile context, which is then added 
>> to the Subject’s private credentials. This feature was designed to 
>> enable the access_token and refresh_token to be set on an 
>> OAuth2AccessTokenPrincipal and passed out of the flow, but you should 
>> also be able to extract the id_token using this method. (see [1]). 
>> You can take a look at the example class [2] as a guide.
>>
>>
>> Phil
>>
>> [1] 
>> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials 
>> <https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials>
>> [2] 
>> https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java
>>> And if I have to get it myself, what is the less ugly way to do it?
>>>
>>> Or is there just no safe way to do it?
>>>
>>> I may have some pressure on this one, because our partner doesn't find
>>> it acceptable that we don't propagate logout.
>>>
>>> Thanks in advance.
>>>
>>> Pierre Sagne.
>>
>> Jisc is a registered charity (in England and Wales under charity 
>> number 1149740; in Scotland under charity number SC053607) and a 
>> company limited by guarantee registered in England under company 
>> number 05747339, VAT number GB 197 0632 86. Jisc's registered office 
>> is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
>> limited by guarantee which is registered in England under company 
>> number 02881024, VAT number GB 197 0632 86. The registered office is: 
>> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>>
>> For more details on how Jisc handles your data see our privacy notice 
>> here: https://www.jisc.ac.uk/website/privacy-notice
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251114/fe1b30e7/attachment.htm>