collective / collective/pas.plugins.oidc

Error in logout with OAM. Missing id_token_hint and state

Open
#80 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6
Forks
16
PR merge metrics
No merged PRs in 30d

Description

I'm not sure yet if this is OAM non-standard but we seem to also get issues with keycloak. It does seem to be part of the standard though - https://support.okta.com/help/s/article/the-purpose-of-id-token-hint-in-the-logout-api-and-how-does-it-affect-the-single-logout-process?language=en_US

With OAM at least you first need to turn off legacy return url option. this will ensure ```client_id`` and ```post_logout_redirect_uri``` are passed to the logout endpoint. However for OAM at least it also requires ```id_token_hint``` and ```state```.

For this particular OAM there is an alternative logout endpoint specified called ```global_logout``` and that doesn't require the additional params however this plugin doesn't yet have an option to pick a custom logout endpoint.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.