diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
index 600e31a08db07800baf38519b405458861ef921e..2f7b97252172afb9ee0cdfd0ac72053f78da8386 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm
@@ -2187,12 +2187,12 @@ sub logout {
                 if ( $rpConf->{oidcRPMetaDataOptionsLogoutType} eq 'front' ) {
                     if ( $rpConf->{oidcRPMetaDataOptionsLogoutSessionRequired} )
                     {
-                        my $user_id = $self->getUserIDForRP( $req, $rp,
-                            $req->{sessionInfo} );
                         $url .= ( $url =~ /\?/ ? '&' : '?' )
                           . build_urlencoded(
                             iss => $self->iss,
-                            sid => $user_id
+                            sid => $self->getSidFromSession(
+                                $rp, $req->{sessionInfo}
+                            )
                           );
                     }
                     $req->info( qq'<iframe src="$url" class="noborder">'
@@ -2309,7 +2309,7 @@ sub metadata {
               [qw/client_secret_post client_secret_basic/],
             introspection_endpoint_auth_methods_supported =>
               [qw/client_secret_post client_secret_basic/],
-            claims_supported                 => [qw/sub iss auth_time acr/],
+            claims_supported                 => [qw/sub iss auth_time acr sid/],
             request_parameter_supported      => JSON::true,
             request_uri_parameter_supported  => JSON::true,
             require_request_uri_registration => JSON::false,
@@ -2338,7 +2338,6 @@ sub metadata {
     # token_endpoint_auth_signing_alg_values_supported
     # display_values_supported
     # claim_types_supported
-    # RECOMMENDED # claims_supported
     # service_documentation
     # claims_locales_supported
     # ui_locales_supported
@@ -2488,11 +2487,12 @@ sub _generateIDToken {
         acr       => $id_token_acr,  # Authentication Context Class Reference
         azp       => $client_id,     # Authorized party, this is used for logout
                                      # TODO amr
+        sid       => $self->getSidFromSession( $rp, $sessionInfo ), # Session id
     };
 
     for ( keys %{$extra_claims} ) {
         $id_token_payload_hash->{$_} = $extra_claims->{$_}
-          if $extra_claims->{$_};
+          if $extra_claims->{$_} and not $id_token_payload_hash->{$_};
     }
 
     # Decided by response_type or forced in RP config
@@ -2504,7 +2504,7 @@ sub _generateIDToken {
 
         foreach ( keys %$claims ) {
             $id_token_payload_hash->{$_} = $claims->{$_}
-              unless ( $_ eq "sub" );
+              unless ( $_ eq "sub" or $_ eq "sid" );
         }
     }
 
diff --git a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
index b995dadf366a1694f79a237c91be1e3e7e7244a9..eab8e2881c42a87663cc5ede7b01d93eb84eabd6 100644
--- a/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
+++ b/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm
@@ -1115,6 +1115,7 @@ sub makeJWT {
         iat       => time,                        # Issued time
         jti       => $id,                         # Access Token session ID
         scope     => $scope,                      # Scope
+        sid       => $self->getSidFromSession( $rp, $sessionInfo ), # Session id
     };
 
     my $claims =
@@ -1125,7 +1126,8 @@ sub makeJWT {
         ->{oidcRPMetaDataOptionsAccessTokenClaims} )
     {
         foreach ( keys %$claims ) {
-            $access_token_payload->{$_} = $claims->{$_};
+            $access_token_payload->{$_} = $claims->{$_}
+              unless $access_token_payload->{$_};
         }
     }
     else {
@@ -2432,6 +2434,26 @@ sub generateNonce {
     return encode_base64url( Crypt::URandom::urandom(16) );
 }
 
+sub getSidFromSession {
+    my ( $self, $rp, $sessionInfo ) = @_;
+    return $self->conf->{cipher}
+      ->encrypt( $sessionInfo->{_session_id} . ':' . $rp );
+}
+
+sub getSessionIdFromSid {
+    my ( $self, $sid, $rp ) = @_;
+    my $str = $self->conf->{cipher}->decrypt($sid);
+    unless ( $str and $str =~ /^(?<id>.*?):(?<rp>.*)$/ ) {
+        $self->logger->error("Invalid sid: $sid");
+        return undef;
+    }
+    if ( $rp and $rp ne $+{rp} ) {
+        $self->logger->error( "RP id mismatch in sid: $rp != " . $+{rp} );
+        return undef;
+    }
+    return $+{id};
+}
+
 1;
 
 __END__