<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">regardless of whether it makes sense to list the services at log out or not, for anyone who wants to check, to see the service that Shibboleth IdP tries to log out of (via front channel),
the following configuration is required:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">idp.logout.elaboration = true<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">idp.logout.propagationHidden = false<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I tested in that case of OIDC metadata (from a JSON-based filesystem resolver) the “client_name” (or language variants of it like client_name#de, etc.) is not shown at logout.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">This should be because in the beans<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><a href="https://codeberg.org/Shibboleth/java-idp-oidc/src/branch/main/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-beans.xml">https://codeberg.org/Shibboleth/java-idp-oidc/src/branch/main/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/oidc/end-session/end-session-beans.xml</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">PopulateMultiRPContextFromLogoutContext does not appear to properly populate the RelyingPartyUIContext Subcontext (in MultiRelyingPartyContext) from OIDC metadata.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I don’t know if that is considered a bug or an unsupported feature.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thus, the propagate.vm (<a href="https://codeberg.org/Shibboleth/java-identity-provider/src/branch/main/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm">https://codeberg.org/Shibboleth/java-identity-provider/src/branch/main/idp-conf-impl/src/main/resources/net/shibboleth/idp/views/logout/propagate.vm</a>)
falls back to the RP ID.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">We can also see a log info from the corresponding class.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">INFO [net.shibboleth.idp.session.impl.PopulateMultiRPContextFromLogoutContext:175] - Profile Action PopulateMultiRPContextFromLogoutContext: No metadata returned for xxxxxx in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor
with protocol http://openid.net/specs/openid-connect-core-1_0.html<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">As Martin suggested, it does work with XML/SAML-based Metadata, but I guess at some point (OIDC Fed) the OIDC client information will unlikely be described by XML.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Holger Wurbs<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Martin Hitschel via users<br>
<b>Sent:</b> Wednesday, October 28, 2026 9:07 AM<br>
<b>To:</b> Max Nuding via users <users@shibboleth.net><br>
<b>Cc:</b> Martin Hitschel <martin.hitschel@daasi.de><br>
<b>Subject:</b> Re: Logging out of an OIDC RP only shows the clientID instead of the name on the logout page<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hi Max,<o:p></o:p></p>
<p>to have a readable client name, you should use SAML metadata XML format for OIDC instead of JSON, see here
<a href="https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile">
https://shibboleth.atlassian.net/wiki/spaces/SC/pages/1912406916/OAuthRPMetadataProfile</a><o:p></o:p></p>
<p>Having this, you can then introduce mdui:UIInfo tags in "SP" metadate, like used in federations, e.g. here
<a href="https://doku.tid.dfn.de/de:metadata">https://doku.tid.dfn.de/de:metadata</a><o:p></o:p></p>
<p>Regards<o:p></o:p></p>
<p>Martin<o:p></o:p></p>
<p><o:p> </o:p></p>
<p class="MsoNormal">Am 28.10.26 um 06:44 schrieb Max Nuding via users:<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hi Scott, <br>
<br>
I forgot to mention: idp.logout.elaboration is set to true! (and works for SAML based SPs).
<br>
I don't see how "display a readable client name instead of a meaningless client ID" is confusing. I'm not talking about hiding the X, I want tom ake it clearer which service they're logging out from.
<br>
<br>
Best <br>
Max <br>
<br>
On 27/10/2026 15:35, Scott Cantor via users wrote: <br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Notably, idp.logout.elaboration defaults to false due to the fact that accessibility requires hiding the UI for logout, so it isn't set to incur the cost unless people just want to run a non-accessible UI.
<br>
<br>
Not to mention, all you're doing is confusing the user, and the red X's are never going away. So it makes reporting the status kind of silly to me.
<br>
<br>
Anyway, that's why I added the flag and defaulted it off to skip all the extra work, and unless it's changed, that would be the reason you won't see anything but the raw IDs.
<br>
<br>
-- Scott <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
<br>
<br>
<o:p></o:p></p>
</blockquote>
<p class="MsoNormal">-- <o:p></o:p></p>
<p><strong><span style="font-family:"Aptos",sans-serif">Dr. MARTIN HITSCHEL | SYSTEM ENGINEER</span></strong><o:p></o:p></p>
<p>+49 7071 407109-0<br>
<a href="mailto:martin.hitschel@daasi.de">martin.hitschel@daasi.de</a><o:p></o:p></p>
<p><strong><span style="font-family:"Aptos",sans-serif">DAASI International GmbH</span></strong><br>
Europaplatz 3<br>
72072 Tübingen, Germany<br>
<a href="http://www.daasi.de">www.daasi.de</a><o:p></o:p></p>
<p>CEOs: David Hübner, Markus Widmer<br>
Registered Office: Tübingen<br>
Commercial Register: Amtsgericht Stuttgart, HRB 382175<o:p></o:p></p>
</div>
</body>
</html>