<div dir="ltr">The requirement that login be available if a login was not processed is incompatible with any form of 'XSRF' protection of the logout endpoint.<div><br></div><div>I propose that we make id_token_hint RECOMMENDED, explain that IDPs MAY require it to be present to perform logout, but not add another mechanism based on client_id, which is solving no problem I am aware of.</div>
<div><br></div><div>So if the IDP supports logout, it may specify id_token_hint required or not, or behave differently (e.g., require user confirmation if id_token_hint absent). You can add a discussion on security considerations.</div>
<div><br></div><div>Again, I am against adding another mechanism for id_token_hint, and I think that the current approach to make it RECOMMENDED is the correct one. I argue for no change except added discussion in security reqs.</div>
<div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jan 20, 2014 at 8:28 AM, Torsten Lodderstedt <span dir="ltr"><<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Hi Todd,<br>
<br>
this page would not necessarily have a client id.<br>
<br>
Regards,<br>
Torsten.<br><br><div class="gmail_quote"><br>
<br>
Todd W Lainhart <<a href="mailto:lainhart@us.ibm.com" target="_blank">lainhart@us.ibm.com</a>> schrieb:<div><div class="h5"><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<font face="sans-serif">Hi Torsten -</font>
<br>
<br><font face="sans-serif">> </font><font size="3">We see the
need to trigger a logout from pages, which did not previously process a
login (portal, landing page).</font>
<br>
<br><font face="sans-serif">Would your page have a client_id available?
It's a requirement that the provided post_logout_uri be registered.
I was trying to intuit how that would be done given the current param
spec, in which the client_id was only available (perhaps) as the "aud"
field of the id_token.<br>
</font>
<br>
<table width="223" style="border-collapse:collapse"><tbody><tr height="8"><td width="223" bgcolor="white" style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px"><font size="1" face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size="1" face="Arial"><b><br>
<a href="tel:1-978-899-4705" value="+19788994705" target="_blank">1-978-899-4705</a><br>
2-276-4705 (T/L)<br>
<a href="mailto:lainhart@us.ibm.com" target="_blank">lainhart@us.ibm.com</a></b></font></td></tr></tbody></table>
<br>
<br>
<br>
<br>
<br><font size="1" color="#5f5f5f" face="sans-serif">From:
</font><font size="1" face="sans-serif">Torsten Lodderstedt
<<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>></font>
<br><font size="1" color="#5f5f5f" face="sans-serif">To:
</font><font size="1" face="sans-serif">Todd W Lainhart/Lexington/IBM@IBMUS,
</font>
<br><font size="1" color="#5f5f5f" face="sans-serif">Cc:
</font><font size="1" face="sans-serif">"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>"
<<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>></font>
<br><font size="1" color="#5f5f5f" face="sans-serif">Date:
</font><font size="1" face="sans-serif">01/18/2014 03:44 AM</font>
<br><font size="1" color="#5f5f5f" face="sans-serif">Subject:
</font><font size="1" face="sans-serif">Re: [Openid-specs-ab]
end_session endpoint parameter specs</font>
<br>
<hr noshade>
<br>
<br>
<br><font size="3">Hi Todd,</font>
<br>
<br><font size="3">I think your proposal to make the id token hint required
if the post logout uri is present limits applicability of the logout mechanism.
We see the need to trigger a logout from pages, which did not previously
process a login (portal, landing page). This would be impossible.</font>
<br>
<br><font size="3">General note: I think the security consideration section
must discuss open redirection at the end session endpoint. I assume registration
of post logout uri serves the purpose of preventing this threat but this
is not documented.</font>
<br>
<br><font size="3">regards,</font>
<br><font size="3">Torsten.</font>
<br><font size="3"><br>
Am 17.01.2014 um 22:45 schrieb Todd W Lainhart <</font><a href="mailto:lainhart@us.ibm.com" target="_blank"><font size="3" color="blue"><u>lainhart@us.ibm.com</u></font></a><font size="3">>:<br>
</font>
<br><font face="sans-serif">Last week I filed:</font><font size="3">
<br>
</font><font size="3" color="blue"><u><br>
</u></font><a href="https://bitbucket.org/openid/connect/issue/914/session-5-missing-client_id-parameter" target="_blank"><tt><font color="blue"><u>https://bitbucket.org/openid/connect/issue/914/session-5-missing-client_id-parameter</u></font></tt></a><font size="3">
<br>
</font><font face="sans-serif"><br>
...where I stated that a required client_id parm was missing that allowed
for the verification of the post_logout_uri value. I've implemented
this endpoint, and I think that I see that this parm may not be necessary.</font><font size="3">
<br>
</font><font face="sans-serif"><br>
Section 5 of the session mgmt. spec says this:</font><font size="3"> <br>
</font><font face="sans-serif"><br>
//===========</font><font size="3"> </font><font face="Verdana"><br>
This specification also defines the following parameters that are passed
as query parameters in the logout request:</font><font size="3"> </font>
<p><font face="Verdana">id_token_hint</font><font size="3"> </font><font face="Verdana"><br>
RECOMMENDED. Previously issued ID Token passed to the logout endpoint as
a hint about the End-User's current authenticated session with the Client.
This is used as an indication of the identity of the End-User that the
RP is requesting be logged out by the OP. The OP need not be listed as
an audience of the ID Token when it is used as an </font><font color="#002060" face="Courier New">id_token_hint</font><font face="Verdana">
value.</font><font size="3"> </font><font face="Verdana"><br>
post_logout_redirect_uri</font><font size="3"> </font><font face="Verdana"><br>
OPTIONAL. URL to which the RP is requesting that the End-User's User Agent
be redirected after a logout has been performed. The value MUST have been
previously registered with the OP, either using the </font><font color="#002060" face="Courier New">post_logout_redirect_uris</font><font face="Verdana">
Registration parameter or via another mechanism. If supplied, the OP SHOULD
honor this request following the logout.</font><font size="3"> </font><font face="sans-serif"><br>
</font><font size="3"><br>
</font><font face="sans-serif"><br>
//===========</font><font size="3"> <br>
</font><font face="sans-serif"><br>
I would reword these definitions to say something along the following lines:</font><font size="3">
<br>
</font><font face="sans-serif"><br>
post_logout_redirect_uri OPTIONAL. The URL to which the RP
is requesting that the End-User's User Agent be redirected to after the
logout has been performed. The value MUST have been previously registered
with the OP, either using the post_logout_redirect_uris Registration parameter
or via another mechanism. If supplied, id_token_hint MUST be specified.</font><font size="3">
<br>
</font><font face="sans-serif"><br>
id_token_hint REQUIRED if "post_logout_redirect_uri" is specified,
otherwise RECOMMENDED. The previously issued ID Token passed to the
logout endpoint as a hint about the End-User's current authenticated session
with the Client. This is used as an indication of the identity of the End-User
that the RP is requesting be logged out by the OP. If "post_logout_redirect_uri"
is specified, then the "aud" member of this token MUST be a single
element, and MUST be the client_id to which the specified "post_logout_redirect_uri"
is registered.</font><font size="3"> <br>
</font><font face="sans-serif"><br>
Additionally, a decision should be made as to whether a state parameter
should be included that can be round-tripped via the post_logout_redirect_uri.
Either that, or the value of the id_token_hint parm is returned via
the post_logout_redirect_uri redirect.</font><font size="3"> <br>
</font><font face="sans-serif"><br>
The implication of this is that the end_session_endpoint can be called
with no parameters, an id_token_hint, or both id_token_hint and post_logout_redirect_uri.</font><font size="3">
</font>
</p><p>
</p><table width="223" style="border-collapse:collapse"><tbody><tr height="8"><td width="221" bgcolor="white" style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px"><font size="3"><br>
<br>
</font><font size="1" face="Verdana"><b><br>
<br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size="1" face="Arial"><b><br>
<a href="tel:1-978-899-4705" value="+19788994705" target="_blank">1-978-899-4705</a><br>
2-276-4705 (T/L)</b></font><font size="1" color="blue" face="Arial"><b><u><br>
</u></b></font><a href="mailto:lainhart@us.ibm.com" target="_blank"><font size="1" color="blue" face="Arial"><b><u>lainhart@us.ibm.com</u></b></font></a></td></tr></tbody></table>
<br>
<br><font size="3">_______________________________________________<br>
Openid-specs-ab mailing list</font><font size="3" color="blue"><u><br>
</u></font><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank"><font size="3" color="blue"><u>Openid-specs-ab@lists.openid.net</u></font></a><font size="3" color="blue"><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank"><font size="3" color="blue"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a>
<br><p></p></blockquote></div></div></div></div><br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>--Breno<br>
</div>