Passing Id_token and claims

[FaresMedMahdi]

Hi everyone,
I am using the version 2.4.14.2 of the module with Okta

Is that a way to passe the id_token and the claims at the same time?

• I am using the default behavior: "OIDCPassIDTokenAs claims" because i am using the claims to add RequestHeader to the request like this:

RequestHeader set X-USER-ID %{OIDC_CLAIM_id_user}e RequestHeader set X-USER-FirstName %{OIDC_CLAIM_firstName}e RequestHeader set X-USER-LastName %{OIDC_CLAIM_lastName}e RequestHeader set X-USER-EMAIL %{OIDC_CLAIM_email}e RequestHeader set X-USER-GROUPS %{OIDC_CLAIM_Groups}e

• Now, I need to implement logout, so I need to get the id_token to pass it as id_token_hint in okta logout endpoint as explained here: https://developer.okta.com/docs/reference/api/oidc/#logout

When I set "OIDCPassIDTokenAs serialized" , I got the id_token but I lost the claims

• I tried to use "OIDCSessionType client-cookie:store_id_token" to store the id_token in the session cookie but I got a not valid token : HTTP_COOKIE="mod_auth_openidc_session=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0**..**AeQ9byMnv91urgXb.YmqF_pNPu8RMH........”
  Thanks in advance

[zandbelt]

OIDCPassIDTokenAs is multi-valued, see: https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.14.2/auth_openidc.conf#L798-L806

however, logout should not be implemented in the application but rather through mod_auth_openidc, see: https://github.com/OpenIDC/mod_auth_openidc/wiki#9-how-do-i-logout-users

[FaresMedMahdi]

Hi Zandbelt,

Thank you for your reply.
I thought that I need to call explicitly the okta endpoint, but finaly it wasn’t needed.