RP-initiated logout post_logout_redirect_uri is not validatable

[rbclark]

I was reading through the OpenID Connect RP-Initiated Logout Spec and I noticed that regarding the post_logout_redirect_uri it mentions:

The value MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism.

Looking at the current end_session_endpoint implementation, it does not provide a way to validate the post_logout_redirect_uri as the spec requires.

For context, the way I'm handling the end_session_endpoint at the moment is as follows:

1. On the OP I have this gem configured with:

   end_session_endpoint do
   Rails.application.routes.url_for({host: ENV["HOST_URL"]}, :destroy_user_session)
   end

   and I have my devise after_sign_out_path set to

   def after_sign_out_path_for(resource)
   if params[:post_logout_redirect_uri].present?
     params[:post_logout_redirect_uri]
   else
     super
   end
   end

2. In my application (using https://github.com/omniauth/omniauth_openid_connect) I am POSTing to /auth/sso/logout which uses the end_session_endpoint and is working properly.