Skip to main content
martin_knyazyan
Level 2
Feb 3, 2026 2:59 PM UTC
Investigating

Feature Request: OOTB ID Token Storage for OIDC in AEMaaCS publisher

Hi Everyone,

Recently, Adobe shipped a feature (SITES-33594) that enables out-of-the-box OIDC support, removing the need for custom authentication handlers. While this works well for standard flows, we’ve encountered a limitation when integrated with Identity Providers like Okta.

The Issue:
When implementing RP-initiated logout, Okta (and similar providers) requires the id_token_hint=<id_token> request parameter to successfully terminate the session on the IDP side.

Technical Gap:
Currently, org.apache.sling.auth.oauth_client.impl.SlingUserInfoProcessor is only designed to store the access_token and refresh_token on the user node. Since the ID token is not persisted, we cannot retrieve it to complete the logout handshake OOTB.

Requirement:
We need a standardized process within the OIDC implementation to store and access ID tokens on the user node, similar to how access and refresh tokens are handled.

Thanks,

Martin

    7 replies

    martin_knyazyanAuthor
    Level 2
    Feb 4, 2026 3:04 PM UTC

    cc: @katuk_sahni

    Translate
    Vishal_Anand
    Vishal_Anand
    Level 6
    Feb 4, 2026 8:15 PM UTC

    ​@martin_knyazyan  Hi Martin - Short answer: we should extend the OIDC flow to persist the ID token on the user node (same pattern as access/refresh tokens) and use it for RP-initiated logout (id_token_hint).

    Key points to implement:

    • Persist id_token via an updated SlingUserInfoProcessor (or an opt-in config) to a secure user property.
    • Ensure encryption/secure storage, TTL/expiry and cleanup on logout or token rotation.
    • Update the logout handler to read id_token and call the IDP with id_token_hint.
    • Add config and migration path, unit/integration tests, and review privacy/ACL implications.

    This keeps OOTB OIDC behavior intact while enabling Okta-style RP logout. Hope this helps.

    ​@kautuk_sahni 

    Translate
    martin_knyazyanAuthor
    Level 2
    Feb 4, 2026 9:04 PM UTC

    Hi ​@Vishal_Anand . Thanks for your response.
    This post is just a feature request for Adobe, to extend the OOTB user info processor, supporting to store id tokens. The current workaround is to create custom UserInfoPostProcessor and implement whatever is implemented now + store id_token, which is not a practical solution in this case.

     

    cc: ​@kautuk_sahni 

    Translate
      martin_knyazyanAuthor
      Level 2
      Feb 5, 2026 1:27 PM UTC

      Ticket created in SLING Jira.
      https://issues.apache.org/jira/browse/SLING-13099

      Translate
      kautuk_sahni
      kautuk_sahni
      Level 9
      Mar 11, 2026 10:59 AM UTC

      Thanks for proposing this idea. This has been reported to the engineering under the internal reference SITES-41688. The product team will triage this request to verify feasibility based on the prioritization model. This post will be updated according to Jira’s status.

      Translate
      Kautuk Sahni
      martin_knyazyanAuthor
      Level 2
      Apr 29, 2026 8:43 AM UTC

      Hi ​@kautuk_sahni Sling already implemented this feature and it was released.
      See - https://issues.apache.org/jira/browse/SLING-13119

      Translate
      kautuk_sahni
      kautuk_sahni
      Level 9
      Mar 11, 2026 12:24 PM UTC
      New→Investigating
      Translate
      Kautuk Sahni
      Terms & ConditionsAccessibility statement

      Loading footer...