<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,</p>
<p>I have made some progress.</p>
<p>I managed to save the id_token with the bean you mentioned,
Philip.</p>
<p>I also managed to get it during attribute resolution by fetching
the SubjectContext from the PRC, then the Subject, and my id_token
with getPrivateCredentials().</p>
<p>Now, the problem I face is getting the id_token when I actually
need it, which is in the logout.vm, where I do my redirection to
the other OIDC logout endpoint.</p>
<p>But I had no luck finding any Subject at this step (no more
SubjectContext in PRC, I guess at this time it has already been
destroyed).</p>
<p>Also no Subject following the path : logoutContext =>
IdPSessions => AuthenticationResults => Subject</p>
<p>Is there a way I can get a subject on the logout page or is it
too late. And if it is too late, is there a way I can grab it
earlier, within a hook and store it somewhere the logout.vm can
get it in the end?</p>
<p>I'm experimenting at this point, but if there is an intended way
to do this, I'd like to do it the right way (or at least in a way
which will cause less problems later).</p>
<p>Thanks a lot.</p>
<p>Best regards,</p>
<pre class="moz-signature" cols="72">Pierre Sagne.
</pre>
<div class="moz-cite-prefix">Le 10/11/2025 à 16:07, Pierre SAGNE via
users a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:6f53cff8-3512-44fa-af99-e1ce174ea472@ac-orleans-tours.fr">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Perfect!</p>
<p>Thanks a lot. I'll look into this. If I have a way to store the
id_token and fetch it on the logout page, I'll be able to call
the logout endpoint with the required parameters.</p>
<p>I'll try to implement that.</p>
<p>Have a nice day</p>
<pre class="moz-signature" cols="72">Pierre Sagne.
Le 10/11/2025 à 16:03, Philip Smart via users a écrit :</pre>
<blockquote type="cite"
cite="mid:A58CE9D2-E6CD-4D68-AE31-4A43786160DD@jisc.ac.uk">
<meta http-equiv="Content-Type"
content="text/html; charset=UTF-8">
<blockquote type="cite"><br>
<pre
style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Thank you for your answer.
And yes, "only forward upstream logout" is what i want and what I have
implemented on another proxy i have implemented with shibboleth idp,
with a simple logout url on the upstream idp (without any parameter : in
fact it was a shibboleth idp local logout on the upstream server).
So if the use case you describe is implemented someday it would totally
fulfill my need.
But I guess for now, I may be forced to implement something on my side.
Is the id_token from the OIDC authentication stored somewhere in
session, or do I have to intercept it and store it myself if I want to
reuse it for logout?
</pre>
</blockquote>
<div>
<p
style="margin: 0px; font-style: normal; font-variant-caps: normal; font-width: normal; line-height: normal; font-size-adjust: none; font-kerning: auto; font-variant-alternates: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-position: normal; font-variant-emoji: normal; font-feature-settings: normal; font-optical-sizing: auto; font-variation-settings: normal;">
<span style="font-kerning: none">Not by default, there is a
hook that allows you to inject a function to extract
information from the profile context, which is then added
to the Subject’s private credentials. This feature was
designed to enable the access_token and refresh_token to
be set on an OAuth2AccessTokenPrincipal and passed out of
the flow, but you should also be able to extract the
id_token using this method. (see [1]). You can take a look
at the example class [2] as a guide.</span></p>
</div>
<div><br>
</div>
Phil
<div><br>
</div>
<div>[1] <a
href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials"
moz-do-not-send="true"><span
style="font-kerning: none; color: rgb(9, 79, 209);">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#Storing-Off-Context-Information-In-Private-Credentials</span></a></div>
<div>[2]
<a class="moz-txt-link-freetext"
href="https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java"
moz-do-not-send="true">https://codeberg.org/Shibboleth/java-idp-plugin-oidc-rp/src/branch/main/idp-oidc-rp-impl/src/main/java/net/shibboleth/idp/plugin/authn/oidc/rp/impl/AccessTokenToPrivateCredentialsMappingStrategy.java</a><br>
<blockquote type="cite">
<pre
style="text-wrap-mode: wrap; font-variant-ligatures: normal; orphans: 2; widows: 2; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">And if I have to get it myself, what is the less ugly way to do it?
Or is there just no safe way to do it?
I may have some pressure on this one, because our partner doesn't find
it acceptable that we don't propagate logout.
Thanks in advance.
Pierre Sagne.</pre>
</blockquote>
</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (in England and Wales
under charity number 1149740; in Scotland under charity
number SC053607) and a company limited by guarantee
registered in England under company number 05747339, VAT
number GB 197 0632 86. Jisc's registered office is: 4
Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary
and a company limited by guarantee which is registered
in England under company number 02881024, VAT number GB
197 0632 86. The registered office is: 4 Portwall Lane,
Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our
privacy notice here: <a class="moz-txt-link-freetext"
href="https://www.jisc.ac.uk/website/privacy-notice"
moz-do-not-send="true">https://www.jisc.ac.uk/website/privacy-notice</a></p>
</font></font> </mc><br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>