Logging out of an OIDC RP only shows the clientID instead of the name on the logout page

[Wurbs, Holger]

Hi all,

regardless of whether it makes sense to list the services at log out or not, for anyone who wants to check, to see the service that Shibboleth IdP tries to log out of (via front channel), the following configuration is required:

idp.logout.elaboration = true
idp.logout.propagationHidden = false

I tested in that case of OIDC metadata (from a JSON-based filesystem resolver) the “client_name” (or language variants of it like client_name#de, etc.) is not shown at logout.

This should be because in the beans
https://codeberg.org/Shibboleth/java-idp-oidc/src/branch/main/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-beans.xml

PopulateMultiRPContextFromLogoutContext does not appear to properly populate the RelyingPartyUIContext Subcontext (in MultiRelyingPartyContext) from OIDC metadata.

I don’t know if that is considered a bug or an unsupported feature.

Thus, the propagate.vm (https://codeberg.org/Shibboleth/java-identity-provider/src/branch/main/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm) falls back to the RP ID.

We can also see a log info from the corresponding class.

INFO [net.shibboleth.idp.session.impl.PopulateMultiRPContextFromLogoutContext:175] - Profile Action PopulateMultiRPContextFromLogoutContext: No metadata returned for xxxxxx in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol http://openid.net/specs/openid-connect-core-1_0.html

As Martin suggested, it does work with XML/SAML-based Metadata, but I guess at some point (OIDC Fed) the OIDC client information will unlikely be described by XML.

Regards,
Holger Wurbs

From: users <users-bounces at shibboleth.net> On Behalf Of Martin Hitschel via users
Sent: Wednesday, October 28, 2026 9:07 AM
To: Max Nuding via users <users at shibboleth.net>
Cc: Martin Hitschel <martin.hitschel at daasi.de>
Subject: Re: Logging out of an OIDC RP only shows the clientID instead of the name on the logout page


Hi Max,

to have a readable client name, you should use SAML metadata XML format for OIDC instead of JSON, see here https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile

Having this, you can then introduce mdui:UIInfo tags in "SP" metadate, like used in federations, e.g. here https://doku.tid.dfn.de/de:metadata

Regards

Martin


Am 28.10.26 um 06:44 schrieb Max Nuding via users:
Hi Scott,

I forgot to mention: idp.logout.elaboration is set to true! (and works for SAML based SPs).
I don't see how "display a readable client name instead of a meaningless client ID" is confusing. I'm not talking about hiding the X, I want tom ake it clearer which service they're logging out from.

Best
Max

On 27/10/2026 15:35, Scott Cantor via users wrote:

Notably, idp.logout.elaboration defaults to false due to the fact that accessibility requires hiding the UI for logout, so it isn't set to incur the cost unless people just want to run a non-accessible UI.

Not to mention, all you're doing is confusing the user, and the red X's are never going away. So it makes reporting the status kind of silly to me.

Anyway, that's why I added the flag and defaulted it off to skip all the extra work, and unless it's changed, that would be the reason you won't see anything but the raw IDs.

-- Scott



--

Dr. MARTIN HITSCHEL | SYSTEM ENGINEER

+49 7071 407109-0
martin.hitschel at daasi.de<mailto:martin.hitschel at daasi.de>

DAASI International GmbH
Europaplatz 3
72072 Tübingen, Germany
www.daasi.de<http://www.daasi.de>

CEOs: David Hübner, Markus Widmer
Registered Office: Tübingen
Commercial Register: Amtsgericht Stuttgart, HRB 382175
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20261028/970e6eff/attachment.htm>