Cannot do OP logout for OKTA

[r-kotagudem]

Okta op logout required to have a query parameter id_token_hint as below including post_logout_redirect_uri
https://dev-<>.okta.com/oauth2/default/v1/logout?post_logout_redirect_uri=<redirect_uri>&id_token_hint=

However, triggering below redirect to OP where id_token_hint will be missing causing error

http://ip/oauth/callback?logout=<redirect_uri>&id_token_hint=

Could you please suggest a solution to do a complete logout (local logout and OP logout)?

[zandbelt]

Can you provide the server debug logs leading up to this?

[zandbelt]

You have to use a server side caching type for the id token to be stored for this purpose

[rahulkumarcisco]

Do you mean there is a way to use server side caching with OIDCSessionType set to "client-cookie" instead of "server-cache"? Could you explain the config details to achieve that? We have requirement to use client_cookie mode to store mod_auth_oidc module session.

[zandbelt]

no, you need to use server-cache

[rahulkumarcisco]

We have multiple clustered apache instances running behind a LB, so using server-cache isn't possible as the OIDC session information isn't shared across multiple Apache instances. That's why we had to use 'client-cookie' for session storage but the logout fails with this setting. Could you suggest best solution for this scenario?

[rahulkumarcisco]

Also raised Issue https://github.com/zmartzone/mod_auth_openidc/issues/908

[zandbelt]

for the record: support for storing the id_token in a client-cookie based session was added in 2.4.12 99373b6