Logging out of an OIDC RP only shows the clientID instead of the name on the logout page

[Max Nuding]

Yep, that looks to be it.

Henri has filed it as an issue for now, so it'll get fixed eventually.

Thanks!
Max

On 28/10/2026 11:32, Wurbs, Holger via users wrote:
> Hi all,
> 
> regardless of whether it makes sense to list the services at log out or 
> not, for anyone who wants to check, to see the service that Shibboleth 
> IdP tries to log out of (via front channel), the following configuration 
> is required:
> 
> idp.logout.elaboration = true
> 
> idp.logout.propagationHidden = false
> 
> I tested in that case of OIDC metadata (from a JSON-based filesystem 
> resolver) the “client_name” (or language variants of it like 
> client_name#de, etc.) is not shown at logout.
> 
> This should be because in the beans
> 
> https://codeberg.org/Shibboleth/java-idp-oidc/src/branch/main/idp-oidc- 
> extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/ 
> oidc/end-session/end-session-beans.xml <https://codeberg.org/Shibboleth/ 
> java-idp-oidc/src/branch/main/idp-oidc-extension-impl/src/main/ 
> resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end- 
> session-beans.xml>
> 
> PopulateMultiRPContextFromLogoutContext does not appear to properly 
> populate the RelyingPartyUIContext Subcontext (in 
> MultiRelyingPartyContext) from OIDC metadata.
> 
> I don’t know if that is considered a bug or an unsupported feature.
> 
> Thus, the propagate.vm (https://codeberg.org/Shibboleth/java-identity- 
> provider/src/branch/main/idp-conf-impl/src/main/resources/net/ 
> shibboleth/idp/views/logout/propagate.vm <https://codeberg.org/ 
> Shibboleth/java-identity-provider/src/branch/main/idp-conf-impl/src/ 
> main/resources/net/shibboleth/idp/views/logout/propagate.vm>) falls back 
> to the RP ID.
> 
> We can also see a log info from the corresponding class.
> 
> INFO 
> [net.shibboleth.idp.session.impl.PopulateMultiRPContextFromLogoutContext:175] - Profile Action PopulateMultiRPContextFromLogoutContext: No metadata returned for xxxxxx in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol http://openid.net/specs/openid-connect-core-1_0.html
> 
> As Martin suggested, it does work with XML/SAML-based Metadata, but I 
> guess at some point (OIDC Fed) the OIDC client information will unlikely 
> be described by XML.
> 
> Regards,
> 
> Holger Wurbs
> 
> *From:*users <users-bounces at shibboleth.net> *On Behalf Of *Martin 
> Hitschel via users
> *Sent:* Wednesday, October 28, 2026 9:07 AM
> *To:* Max Nuding via users <users at shibboleth.net>
> *Cc:* Martin Hitschel <martin.hitschel at daasi.de>
> *Subject:* Re: Logging out of an OIDC RP only shows the clientID instead 
> of the name on the logout page
> 
> Hi Max,
> 
> to have a readable client name, you should use SAML metadata XML format 
> for OIDC instead of JSON, see here https://shibboleth.atlassian.net/ 
> wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile <https:// 
> shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/ 
> OAuthRPMetadataProfile>
> 
> Having this, you can then introduce mdui:UIInfo tags in "SP" metadate, 
> like used in federations, e.g. here https://doku.tid.dfn.de/de:metadata 
> <https://doku.tid.dfn.de/de:metadata>
> 
> Regards
> 
> Martin
> 
> Am 28.10.26 um 06:44 schrieb Max Nuding via users:
> 
>     Hi Scott,
> 
>     I forgot to mention: idp.logout.elaboration is set to true! (and
>     works for SAML based SPs).
>     I don't see how "display a readable client name instead of a
>     meaningless client ID" is confusing. I'm not talking about hiding
>     the X, I want tom ake it clearer which service they're logging out
>     from.
> 
>     Best
>     Max
> 
>     On 27/10/2026 15:35, Scott Cantor via users wrote:
> 
>         Notably, idp.logout.elaboration defaults to false due to the
>         fact that accessibility requires hiding the UI for logout, so it
>         isn't set to incur the cost unless people just want to run a
>         non-accessible UI.
> 
>         Not to mention, all you're doing is confusing the user, and the
>         red X's are never going away. So it makes reporting the status
>         kind of silly to me.
> 
>         Anyway, that's why I added the flag and defaulted it off to skip
>         all the extra work, and unless it's changed, that would be the
>         reason you won't see anything but the raw IDs.
> 
>         -- Scott
> 
> 
> 
> 
> -- 
> 
> *Dr. MARTIN HITSCHEL | SYSTEM ENGINEER*
> 
> +49 7071 407109-0
> martin.hitschel at daasi.de <mailto:martin.hitschel at daasi.de>
> 
> *DAASI International GmbH*
> Europaplatz 3
> 72072 Tübingen, Germany
> www.daasi.de <http://www.daasi.de>
> 
> CEOs: David Hübner, Markus Widmer
> Registered Office: Tübingen
> Commercial Register: Amtsgericht Stuttgart, HRB 382175
> 
> 

-- 
Herr Max Nuding
Softwareentwickler / Abt. IT-Dienste für Forschung und Lehre
Kommunikations-, Informations-, Medienzentrum (KIM)
Universität Konstanz
78457 Konstanz
Tel.: +49.7531.88-4658
Raum: B 707

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5056 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20261029/a9cd93d0/attachment.p7s>