Logout

[Johannes Ernst]

So far, neither OpenID nor CardSpace define the notion of a session,  
so no common logout is possible within the standard protocols.

What we do in our code at NetMesh is to add a convention where
     RP-URL?lid=OPENID
is the same thing as "submitted OpenID URL in the first form", to  
which the RP-URL responds with a redirect to the OP, while
     RP-URL?lid=
means "become anonymous again" aka "logout".

There are substantial usability issues with common logout in a  
decentralized, "internet-scale" approach, however, that nobody has  
really solved as far as I know.


On Apr 6, 2007, at 9:15, McGovern, James F ((HTSC, IT)) wrote:

> Curious question that someone asked that I didn't know the answer  
> to. OpenID/Cardspace allow for easy SSO into web sites. How does  
> one perform the equivalent logout from an Identity Selector?
>
>
>
> ********************************************************************** 
> ***
> This communication, including attachments, is
> for the exclusive use of addressee and may contain proprietary,
> confidential and/or privileged information. If you are not the  
> intended
> recipient, any use, copying, disclosure, dissemination or  
> distribution is
> strictly prohibited. If you are not the intended recipient, please  
> notify
> the sender immediately by return e-mail, delete this communication and
> destroy all copies.
> ********************************************************************** 
> ***
> _______________________________________________
> specs mailing list
> specs at openid.net
> http://openid.net/mailman/listinfo/specs

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs/attachments/20070406/ba42d8bb/attachment-0002.htm>