<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Perfect!</p>
<p>Thanks a lot. I'll look into this. If I have a way to store the
id_token and fetch it on the logout page, I'll be able to call the
logout endpoint with the required parameters.</p>
<p>I'll try to implement that.</p>
<p>Have a nice day</p>
<pre class="moz-signature" cols="72">Pierre Sagne.
Le 10/11/2025 à 16:03, Philip Smart via users a écrit :</pre>
<blockquote type="cite"
cite="mid:A58CE9D2-E6CD-4D68-AE31-4A43786160DD@jisc.ac.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<blockquote type="cite"><br>
<pre
style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Thank you for your answer.
And yes, "only forward upstream logout" is what i want and what I have
implemented on another proxy i have implemented with shibboleth idp,
with a simple logout url on the upstream idp (without any parameter : in
fact it was a shibboleth idp local logout on the upstream server).
So if the use case you describe is implemented someday it would totally
fulfill my need.
But I guess for now, I may be forced to implement something on my side.
Is the id_token from the OIDC authentication stored somewhere in
session, or do I have to intercept it and store it myself if I want to
reuse it for logout?
</pre>
</blockquote>
<div>
<p
style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; line-height: normal; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;">
<span style="font-kerning: none">Not by default, there is a
hook that allows you to inject a function to extract
information from the profile context, which is then added to
the Subject’s private credentials. This feature was designed
to enable the access_token and refresh_token to be set on an
OAuth2AccessTokenPrincipal and passed out of the flow, but
you should also be able to extract the id_token using this
method. (see [1]). You can take a look at the example class
[2] as a guide.</span></p>
</div>
<div><br>
</div>
Phil
<div><br>
</div>
<div>[1] <a
href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials"
moz-do-not-send="true"><span
style="font-kerning: none; color: rgb(9, 79, 209);">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials</span></a></div>
<div>[2]
<a class="moz-txt-link-freetext" href="https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java">https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java</a><br>
<blockquote type="cite">
<pre
style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">And if I have to get it myself, what is the less ugly way to do it?
Or is there just no safe way to do it?
I may have some pressure on this one, because our partner doesn't find
it acceptable that we don't propagate logout.
Thanks in advance.
Pierre Sagne.</pre>
</blockquote>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (in England and Wales under
charity number 1149740; in Scotland under charity number
SC053607) and a company limited by guarantee registered in
England under company number 05747339, VAT number GB 197
0632 86. Jisc's registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary
and a company limited by guarantee which is registered in
England under company number 02881024, VAT number GB 197
0632 86. The registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our
privacy notice here:
<a class="moz-txt-link-freetext" href="https://www.jisc.ac.uk/website/privacy-notice">https://www.jisc.ac.uk/website/privacy-notice</a></p>
</font></font>
</mc><br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>