[OIDC] Logout without having the original Id Token

Questions OAuth/OIDC
1

The ALB forwards Okta’s original access_token to our apps, but instead of forwarding Okta’s ID Token, AWS composes a new one with the claims obtained from the /userinfo endpoint, signs this token and forwards it to our apps

The problem comes when we want to logout the user from the application and Okta’s authorization server (so that user has to enter credentials again in Okta’s login page).

Okta’s documentation for the /logout endpoint asks for an ID Token being passed in the id_token_hint query parameter but our applications don’t have access to Okta’s ID token, but rather AWS’s one

  • Has anybody dealt with this issue before and found a workaround?

  • Is there a way to obtain an ID Token from Okta after the token exchange if we posses a valid access token?

  • Is there any other way of logging our users from the app in Okta?

Thanks in advance for your help!

2

Do you only have a valid access token? Would it be possible to be forwarded along a refresh token as well? That way your application could refresh the users tokens and, as long it is requesting the openid scope, receive an ID token.

3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.