<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><a href="http://openid.net/specs/openid-connect-backchannel-1_0-01.html">http://openid.net/specs/openid-connect-backchannel-1_0-01.html</a> cleans up some text left over from the HTTP-Based Logout spec and clarifies
the conditions under which HTTP 504 Gateway Timeout is returned.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Mike Jones
<br>
<b>Sent:</b> Wednesday, September 09, 2015 11:54 PM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Initial back-channel logout specification published<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After our working group conversation on the Thursday call, I sat down on Friday and wrote a first draft of the back-channel logout specification. I incorporated a few improvements suggested by John Bradley since then. The resulting spec
has now been published as <a href="http://openid.net/specs/openid-connect-backchannel-1_0-00.html">
http://openid.net/specs/openid-connect-backchannel-1_0-00.html</a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This specification defines a logout mechanism that uses back-channel communication between the OP and RPs being logged out; this differs from front-channel logout mechanisms, which communicate logout requests from the OP to RPs via the
User Agent.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The OP POSTs a Logout Token – like an ID Token, but with slightly different claims – to the RP’s back-channel logout endpoint to request that the RP log out. It’s up to the RP to implement a mechanism that accepts these requests and acts
upon them – locating and logging out the specified End-User session at the RP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please review the specification and also compare it to <a href="http://openid.net/specs/openid-connect-logout-1_0-03.html">
http://openid.net/specs/openid-connect-logout-1_0-03.html</a>. There are some ways we may want to make them more parallel, but John and I decided to publish this as-is now and then have working group discussions on the right directions to take both specs.
The use of the Session ID is where the specs are currently the most different from one another.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The creation of this specification resolves issue #922 – Session cleanup via back-channel –
<a href="https://bitbucket.org/openid/connect/issues/922/session-cleanup-via-back-channel">
https://bitbucket.org/openid/connect/issues/922/session-cleanup-via-back-channel</a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Also, see my public description of the specification and the motivation for it at
<a href="http://self-issued.info/?p=1452">http://self-issued.info/?p=1452</a> and on
<a href="https://twitter.com/selfissued">@selfissued</a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> -- Mike<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>