Hi, the

end_session_endpoint

in the discovery document includes the ID of the federated app, not the project ID, but when the URL is executed, an error is returned about the project ID not being specified.

{
  "errorCode": "E011002",
  "errorDescription": "Request is missing required arguments",
  "errorMessage": "Failed to handle oidc endsession request, missing project id",
  "message": "Failed to handle oidc endsession request, missing project id"
}

Should the project ID not be included in the URL if it is actually required by the back-end? Can this be fixed or do we need to try to override this ourselves? Note: we are not using the SDK, we are using the hosted redirect approach.

If the

end_session_endpoint

in the discovery document is returning an app-scoped URL that errors without a project ID, that may be a backend/discovery doc inconsistency. Adding

project_id

is the safest workaround for now. A couple quick questions to help us pinpoint this: 1. Are you passing a valid

id_token_hint

today? 2. What exact

end_session_endpoint

value are you getting from the discovery document? 3. Are you using a custom auth domain or the default Descope domain? Once we have that, we can confirm whether this is expected behavior or something we should fix on our side.

thanks for getting back to me. 1. with the approach we are using, I don’t have access to the

id_token

but can include the

client_id

, which seems to work, but I’m having to override library code to do that as the library is relying on the

end_session_endpoint

from the discovery document and is not expecting to have to make amendments 2. this is the discovery URL: https://auth.qa3.bookings.share.car/P340r6TdfHXZDZtfoq4hzW4uULRW/SA37Ck1m3XPmeiHGxsjunbjMalccK/.well-known/openid-configuration, which does match what is in the federated app settings, but it feels like it should include the project ID if the project ID is actually required 3. yes, we are using a custom domain

Got it, thanks for the details. Going to run some tests on my end to verify if this is expected behavior. In the meantime, I would recommend to keep using the discovery-provided

end_session_endpoint

, but append

client_id=<PROJECT_ID>

when you don’t have

id_token_hint

. That’s consistent with how RP-Initiated Logout is typically implemented across OPs when ID token isn’t available.

thanks