The Purpose of "id_token_hint" in the /logout API and How Does it Affect the Single Logout Process Within Okta
Last Updated:
Overview
The id_token_hint parameter is a required component in requests to the /logout endpoint during OpenID Connect (OIDC) flows. This parameter provides a hint to the Okta Authorization Server about the end-user session that the application requests for logout. Administrators must pass a valid JSON Web Token (JWT) that the Okta Authorization Server issues as a raw string to successfully complete the Single Logout (SLO) process.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- Single Logout (SLO)
/logoutAPI Endpoint
Solution
What is the purpose of the id_token_hint parameter?
The id_token_hint parameter is a required parameter for requests to the /logout endpoint in OIDC flows. The parameter provides a hint to the Okta Authorization Server about the end-user session that the application requests for logout. The id_token_hint is a valid JWT that the Okta Authorization Server issues when using any of the OIDC flows (either the Org Authorization Server or a Custom Authorization Server) as part of the openid scope. The id_token_hint requires passing the original ID Token (that Okta issues to the client application after the authentication process) as a raw JWT string.
A raw JWT string is a sequence of encoded characters separated by periods, as demonstrated in the following sample ID token that Okta issues after a successful application login when the application requests the openid scope.
eyJraWQiOiJ5dnkwVUNvZGlSWVBCVzBnZTdVRy1GdFNhbUZla3BoVjcyRUJCQlJHQi1vIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiIwMUxbmR0bG5sbXZxYWJ3TzFkOCIsIm5hbWUiOiJSYW5nYSBQcmFrYXNoIFMiLCJsb2NhbGUiOJJTiIsImVtYWlsIjoicmFuZ2EucHJha2FzaEBva3RhLmNvbSIsIZlciI6MSwiaXNzIjoiaHR0cHM6Ly9va3RhLm9rdGEuY29tIiwiYXVkIjoib2t0YS4yYj5NTljOC1iYY29tIiwiZ2l2ZW5fbmFtZSI6IlJhbmdhIFByYWthc2giLCJmYW1pbHlfbmFtZSI6MiLCJ6b25laW5mbyI6IkFzaWEvQ9sb21ibyIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiYXV0aF90aW1lIjoxNzQzNzU0MTExLCJhdF9oYXNoIjoiUjNWb2JfaVhmSU1kcF93aDE4cDNyUSJ9.EJbuGeOTmGiloswI7_hxTkUnUhHAG5614VYVYSAwiiAZkNlFHAf_YagE3SySpuE2AZyKaaFqDvIJ2KBgf5ZEpxhiOMCJEGhAQ0nAUZtVb1ROLLrRhzClpm3TQiRbijcJZEJvpzlyXzDngY4AIwL0B8GYy4GqiPsdEa20YHYqMyNdMvdMlhxxumlTSFDn28kL4zW7e0Hwqloa8mQK8p1LkCYh3LCIi8aDEGX-NOTE: The id_token_hint value is not the username, email, or User Principal Name (UPN) of the logged-in user.
The value must be an ID Token JWT string containing all three parts of the JWT (the header, payload, and signature). The Okta Authorization Server receiving the /logout call must be the issuer of this token. For example, if the Default Authorization Server issues the token, send the token to the Logout endpoint for that same authorization server endpoint: /oauth2/default/v1/logout.
Okta Processes an Expired but Valid id_token_hint Under Specific Conditions
If the ID token is valid but expired, and the subject matches the current Okta session, Okta signs the user out and redirects the browser to the post_logout_redirect_uri.
Because Okta formats ID Tokens as JWTs, standard JWT decoders can decode a valid token to display information about the token contents. Use an online tool like jwt.io to decode and validate the token, or to debug signature issues. This is an example only; use a tool that best fits the organization's guidelines for these types of tools.
