[Openid-specs-ab] Login Initiation endpoint.

Mike Jones Michael.Jones at microsoft.com
Mon Nov 25 16:34:47 UTC 2013

I think it would be useful for you to give us several elements of context:

1.  There was some kind of attack envisioned that led us to have the RP always effectively initiate the login.  What was that attack and how does that attack relate to this new functionality?

2.  What equivalent parameter(s) does SAML use that enable it to have fewer round trips?  Is SAML susceptible to the above attack?

3.  What's the rationale for the short expiration time?

                                                            -- Mike

From: openid-specs-ab-bounces at lists.openid.net [mailto:openid-specs-ab-bounces at lists.openid.net] On Behalf Of John Bradley
Sent: Monday, November 25, 2013 7:58 AM
To: Openid-specs Ab
Subject: [Openid-specs-ab] Login Initiation endpoint.

For Core Section 3 I would like to add the following optional parameter to the login initiation endpoint.

OPTIONAL. If the initiator is the iss then it may include an initial id_token.  The value of exp SHOULD be set to a small value in the range of 5 minutes.
The id_token must contain a valid aud restricting it to the client receiving it.
If the client receives a value for this string-valued parameter, it MUST include it in the subsequent authorization request as the id_token_hint parameter value.

I have been getting push back from people looking to convert from SAML that Connect forces many more round trips than SAML for doing IdP initiated login.
Sending an initial short lived id_token lets the client do the quick customization of the UI that the id_token was intended to enable while allowing the client to get access tokens and a new id_token in the background using prompt=none.

This also reduces the eventual pressure to add more parameters to the endpoint as the AS can tack on additional claims it needs to maintain state.

I think we did have the id_token as a parameter at wine point then changed it to the login_hint when that was added to make it more general.

I know this is a late addition request.

John B.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20131125/a6aba88d/attachment.html>

More information about the Openid-specs-ab mailing list