Logout Test - RP Initiated should validate id_token_hint is present

Issue

Conformance suite is testing a case when they don’t include id_token_hint param in the request to end_session endpoint.

Current implementation

Logout is processed and after that the user agent is redirected to the url in post_logout_redirect_uri.

Expected result

According to the documentation we have to validate id_token_hint param for security considerations and stop the process if it is not present. Another platform shows an invalid_request error message whether this one is not sent.

Test log:

https://op.certification.openid.net:62152/test_info/OP-RpInitLogout-No-id_token_hint

End session url:

https://jenkins-ldap.gluu.org/oxauth/restv1/end_session?post_logout_redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A62152%2Flogout&state=D7ajugCIxZBKWr3Re3QLSF2BLconFw7s

[yuriyz]

I see, introduced new configuration property forceIdTokenHintPrecense. So you can test it with fapiCompatibility=false && forceIdTokenHintPrecense=true.

[miltonbo]

@yuriyz We have an issue very similar than oxTrust with oxAuth. Now that I’m using ce-ob.gluu.org environment to pass logout tests, conformance suite is sending wrong parameters, it doesn’t include request param, but we have fapiCompatibility activated and an invalid_request error is gotten.

Authorization url created by the conformance suite

https://ce-ob.gluu.org/oxauth/restv1/authorize?state=IqjEjyC98q8uWVct&nonce=5yVJBCdutXOC72yD&response_type=id_token+token&scope=openid+offline_access&redirect_uri=https%3A%2F%2Fop.certification.openid.net%3A62175%2Fauthz_cb&prompt=consent&client_id=1d88aae1-e5a5-40ec-a077-a4c7ed438430