amichal
commented
3 years ago For those who get here because of the logout API reference:
When you have a valid id_token and id_info you can do this to build the OIDC logout API URL something like this. "auth" in this case is the payload you get in Devise::OmniauthCallbacksController request.env['omniauth.auth']. Presumably you stashed what you need from it.
def idp_logout_url(auth, post_logout_redirect_uri: nil, state: nil)
issuer = auth.dig('extra', 'id_info', 'iss')
id_token = auth.dig('credentials', 'id_token')
return unless issuer.present? && id_token.present?
"#{issuer}/v1/logout?" + {
id_token_hint: id_token,
post_logout_redirect_uri: post_logout_redirect_uri,
state: state,
}.compact.to_param
end
Andrew-Tolentino
erikpaulmiller
rience
BobbyMcWho
ryanswood
We needed to implement the logout flow for OKTA. Docs here https://developer.okta.com/docs/reference/api/oidc/#logout. It is not super clear but the
id_token_hintparam is expected to be theid_tokenprovided by OKTA in response the/tokenrequest.It turns out that the
id_tokenandid_infofield inextrawhere being populated from the access_token instead of the id token. The attached change fixes that to return theid_token.I kept the nil check but the token should always be present in the response of https://developer.okta.com/docs/reference/api/oidc/#token as long we request the openid scope.