<html aria-label="message body">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<blockquote type="cite"><br>
<pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Thank you for your answer.
And yes, "only forward upstream logout" is what i want and what I have
implemented on another proxy i have implemented with shibboleth idp,
with a simple logout url on the upstream idp (without any parameter : in
fact it was a shibboleth idp local logout on the upstream server).
So if the use case you describe is implemented someday it would totally
fulfill my need.
But I guess for now, I may be forced to implement something on my side.
Is the id_token from the OIDC authentication stored somewhere in
session, or do I have to intercept it and store it myself if I want to
reuse it for logout?
</pre>
</blockquote>
<div>
<p style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; line-height: normal; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;">
<span style="font-kerning: none">Not by default, there is a hook that allows you to inject a function to extract information from the profile context, which is then added to the Subject’s private credentials. This feature was designed to enable the access_token
and refresh_token to be set on an OAuth2AccessTokenPrincipal and passed out of the flow, but you should also be able to extract the id_token using this method. (see [1]). You can take a look at the example class [2] as a guide.</span></p>
</div>
<div><br>
</div>
Phil
<div><br>
</div>
<div>[1] <a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials"><span style="font-kerning: none; color: rgb(9, 79, 209);">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials</span></a></div>
<div>[2] https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java<br>
<blockquote type="cite">
<pre style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">
And if I have to get it myself, what is the less ugly way to do it?
Or is there just no safe way to do it?
I may have some pressure on this one, because our partner doesn't find
it acceptable that we don't propagate logout.
Thanks in advance.
Pierre Sagne.</pre>
</blockquote>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered
office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>