manual-oidc-logout-id-token

Storing the id_token alongside access and refresh tokens during manual code redemption ensures the id_token_hint is available for RP-initiated logout. This allows the identity provider to successfully identify and terminate the correct user session.

Persist the ID token by configuring your authentication properties to include the id_token in the stored token set within authentication cookies during manual code redemption. This ensures the token is accessible for backfilling the id_token_hint during sign-out redirects.

Yes, this approach to fixing OIDC logout works with Keycloak and Umbraco Prism. It specifically addresses session termination issues in custom OIDC integrations where default framework token handling is bypassed during manual authentication flows.

The id_token_hint in OIDC sign-out redirects is used by the identity provider to identify the user session that needs to be terminated. It is automatically backfilled during the sign-out redirect process if the id_token was properly persisted.

Yes, you must register the sign-out callback URI with your OIDC provider to ensure that logging out of the application successfully terminates the session at the identity provider level and redirects the user correctly after logout.