Implement native OpenID Connect (OIDC) Relying Party (RP) Initiated Logout by dynamically discovering the Identity Provider's end_session_endpoint via the .well-known/openid-configuration endpoint.

Currently, when IBM Safer Payments is integrated with an external SSO Identity Provider (IdP) and a user clicks the "Logout" button, the application executes a local session termination by navigating the browser to the root URL with a JSON payload query string: /?{"request":"logout"}.

This behavior introduces critical architectural and security challenges in enterprise SSO environments:

• Orphaned IdP Sessions: The local Safer Payments session is destroyed, but the user is not redirected to the IdP to destroy the overarching SSO token, leaving the session active at the IdP level.
• WAF/Load Balancer Workaround Failures: Attempting to intercept the /?{"request":"logout"} string at the edge (via WAF or Load Balancer) to redirect the user to the IdP is incompatible with strict IdPs (such as Azure AD B2C). These IdPs strictly validate the post_logout_redirect_uri and will reject the URL-encoded JSON payload as an invalid format (e.g., resulting in Azure error AADB2C90067), preventing a clean return to the Safer Payments login screen.
  
  3. Proposed Solution (Desired Behavior)

IBM Safer Payments should fully conform to the OIDC RP-Initiated Logout specification.

When SSO is enabled, Safer Payments should:

1. Discover the Logout Endpoint: During the initial IdP configuration (or dynamically at runtime), Safer Payments should call the IdP's standard Discovery endpoint (.well-known/openid-configuration) and extract the end_session_endpoint value.
2. Execute Local Logout: When a user clicks the "Logout" button in the UI, Safer Payments should immediately invalidate the local application session on the backend.
3. Execute Remote Redirect: Instead of returning the user to /?{"request":"logout"}, Safer Payments should issue an HTTP 302 Redirect to the discovered end_session_endpoint.
4. Pass Clean Parameters: Safer Payments should dynamically append a clean, configurable post_logout_redirect_uri (e.g., the base URL of the environment, without JSON query strings) to the redirect, ensuring strict IdPs accept the request.

4. Example / Use Case

If configured against Azure AD B2C, clicking the Safer Payments logout button should natively and automatically redirect the user's browser to the discovered URL

5. Business Value

• Security & Compliance: Ensures complete session destruction across both the application and the enterprise IdP, closing a potential vulnerability loop for shared workstations.
• Reduced Infrastructure Complexity: Eliminates the need for clients to build complex, edge-routing WAF rules or URL maps to intercept messy query strings just to achieve a standard SSO logout flow.
• Standards Adherence: Brings Safer Payments into full alignment with modern OIDC Discovery and Session Management standards.