Get Client in Logout

[honzapatCZ]

Is your feature request related to a problem? Please describe.
Well, I wanted to make the logout endpoint consider some stuff in the client metadata(eg firstparty) to skip the UI even when its Client initiated request.

Describe the solution you'd like
I suppose extending the endpoint for passing along the client too(which is there already so idk why its not passed)

Describe alternatives you've considered
If I would knew where I could fetch session_id data I would prob. use that

[vinckr]

You mean this step of the logout flow?

3. The logout provider uses the challenge query parameter to fetch metadata about the request. The logout provider may choose to show a UI where the user has to accept the logout request. Alternatively, the logout provider MAY choose to silently accept the logout request.

The server response is a JSON object with the following keys:

{
  // The user for whom the logout was request.
  "subject": "user-id",

  // The login session ID that was requested to log out.
  "sid": "abc..",

  // The original request URL.
  "request_url": "https://hydra/oauth2/sessions/logout?id_token_hint=...",

  // True if the request did not include a id_token_hint. False otherwise.
  "rp_initiated": true | false
}

Can you give me some details what you mean by passing the client along?
The sid is part of the response, would that work?

[honzapatCZ]

Yep, exactly, I know about the sid, but how can I get client info fram that?
Also looking at source the client is already somehow fetched, so all Iam asking for is having it in the response in case it's rp_initiated and that would also possibly make rp_initiated redundant since in case it is rp_initiated the client would be set if not it would be null

[pommelinho]

I would suggest to use https://www.ory.sh/hydra/docs/reference/api/#lists-all-consent-sessions-of-a-subject to get all sessions of the subject. Then you could just filter the result for the login_session_id corresponding to the sid. Then you would get the corresponding client information.

However I also would like it to get the client info right away from hydra when making the logout request

[honzapatCZ]

This seems like a really bad idea and also very performance consuming

[pommelinho]

As I said I am also interested in having the client info already in the response of the logout request.
However this is the only workaround i currently see to get this information :(

[honzapatCZ]

@aeneasr worth a PR?

[aeneasr]

@honzapatCZ @pommelinho we can not include the ClientID because a single login session (sid) can be linked to multiple clients because login and consent are two separate things.

We currently do not keep track of what clients use a sid so this would need some work.

[aeneasr]

#2468 (comment):

"request_url": "https://hydra/oauth2/sessions/logout?id_token_hint=...",

[pommelinho]

@honzapatCZ ok when having the client_id. this would mean that you then would use https://www.ory.sh/hydra/docs/reference/api/#get-an-oauth-20-client to get the client and its metadata, right?

[honzapatCZ]

#2468 (comment):

"request_url": "https://hydra/oauth2/sessions/logout?id_token_hint=...",

OK, but that is an ID token hint, so I would have to parse that and get the client from there.

If I make a PR and make it return a client also if its rp_initiated?

[aeneasr]

Makes sense!

[honzapatCZ]

Makes sense!

Wait there already is client in the definition

hydra/consent/types.go

Line 421 in 24f91ab

Client *client.Client `json:"-" db:"-"`

[vinckr]

Hey @honzapatCZ, just checking in if your problem still persists.
I will mark this as answered for now, but feel free to come back to the discussion any time.
Thanks a ton 🐝