<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">You can still do that. This is just a hint to tell you you might want to, you’re free to ignore it.<div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""><div style=""><blockquote type="cite" class=""><div class="">On Feb 4, 2016, at 11:28 AM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" class="">sakimura@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class="">It is potentially useful, though in some other cases, the client may want to hit the Userinfo endpoint without user login just to see if the data is fresh. <div class="">Insurance companies tends to fall in this category. </div><div class=""><br class=""></div><div class="">Best, </div><div class=""><br class=""></div><div class="">Nat</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="">2016年2月5日(金) 1:05 Justin Richer <<a href="mailto:jricher@mit.edu" class="">jricher@mit.edu</a>>:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">One of the good things in OIDC is the fact that the claims about a user are split between the ID Token (things that are needed for the authN transaction) and the user info endpoint (things that are needed for the profile and other functions of the app). Theoretically it cuts down on sending redundant and unchanging information with each authentication. However, the tension of whether and when an RP should pull from the IdP’s UserInfo Endpoint is an age old question of cache consistency. Should the RP call on each transaction? After a time out? When it really really wants to?<br class="">
<br class="">
Anyway, I think there’s a simple way that the IdP can signal to the RP whether it’s worth pulling information. If the IdP always includes the “last_updated” claim in the ID token, the RP can decide whether its cache of UserInfo is fresh enough or not by doing a simple comparison on that value and its local cache. It’s coarse grained, because you don’t know if you care about whatever claim was updated or not, but it’s at least *some* signal that can be used inside an already existing structure.<br class="">
<br class="">
We’re considering just implementing this in our server and client, but I’d like to see what others thought of this idea and if it would be worthwhile propagating this pattern. I feel it’s very low overhead in the ID Token for a potentially big benefit of live data and lower network traffic from the RP.<br class="">
<br class="">
— Justin<br class="">
_______________________________________________<br class="">
Openid-specs-ab mailing list<br class="">
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank" class="">Openid-specs-ab@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br class="">
</blockquote></div>
</div></blockquote></div><br class=""></div></body></html>