<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Florian,<div class=""><br class=""></div><div class="">thank you for the responses!</div><div class=""><br class=""></div><div class="">> I think most times this happens, it is directly at the OP (or at least it's storage) so is this really a use-case for OP initiated Back-channel Logout? The OP can in this case decide by itself to cancel sessions and trigger RP's about this. Maybe you can elaborate in which setup you find this case.</div><div class=""><br class=""></div><div class="">Depends on the implementation of the OP. For ORY Hydra or CoreOS Dex, which are more or less „OpenID OP Proxies“ this would not be at the OP directly, but instead at the IdP (the actual user database that implements signup, account reovery et al). Since OIDC does not specify anything regarding user registration and other basic flows I would assume that this is an intended operational model. For example when having an existing user system and wanting to add OIDC support. In that case the original user system would do the password change, and the „OIDC support“ would need to be notified of that change in order to trigger a logout, which in turn triggers OIDC Backchannel Logout. My question is if there’s any guidance (e.g. API wise or security wise „don’t do this and that!!!“) around that.</div><div class=""><br class=""></div><div class="">Hope this clarifies my question!</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 29.04.2020 um 20:09 schrieb Florian Forster <<a href="mailto:florian@caos.ch" class="">florian@caos.ch</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div dir="auto" class="">Me again</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">I think I took a wrong turn interpreting your email on my phone :-)</div></div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">If I understand you correctly you search more or less this one<br class=""></div><div dir="auto" class="">-> <div class=""><a href="https://openid.net/specs/openid-connect-backchannel-1_0.html" class="">https://openid.net/specs/openid-connect-backchannel-1_0.html</a></div></div><div dir="auto" class=""><br class=""></div><div class=""><div dir="auto" class="">Which basically defines a URL Endpoint within the RP where the OP can send a JWT. Is it in your use-case a problem for the OP to track the clients on which RP they did sign-in?</div><div dir="auto" class=""><br class=""></div><div dir="auto" class="">Greets</div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 29 Apr 2020 at 17:17, Florian Forster <<a href="mailto:florian@caos.ch" class="">florian@caos.ch</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class="">Hi Aeneas</div><div dir="ltr" class=""><br class=""></div><div dir="ltr" class="">Below some questions/answers. Maybe I did not fully get your idea :-) <br class=""><div class=""><br class=""></div><div class="">...when the user changes his/her password.</div><div class="">> I think most times this happens, it is directly at the OP (or at least it's storage) so is this really a use-case for OP initiated Back-channel Logout? The OP can in this case decide by itself to cancel sessions and trigger RP's about this. Maybe you can elaborate in which setup you find this case.</div><div class=""><br class=""></div><div class="">...banned by an administrator which in turn should trigger OIDC Back-Channel Logout.</div><div class="">> Is the user banned from the RP or the OP? Because, if it is a Identity-Lifecycle thing, where the user is completely locked I find services like SCIM 2.0 the proper tool. After an account deactivation we could do the same as my answer above states.</div><div class=""><br class=""></div><div class="">Greetings Florian</div><div class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><span class=""><br class=""><div dir="ltr" style="margin-left:0pt" class=""><table style="border:none;border-collapse:collapse" class=""><colgroup class=""><col width="198" class=""><col width="402" class=""></colgroup><tbody class=""><tr style="height:103pt" class=""><td style="vertical-align:top;padding:5pt" class=""><div style="line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 11pt; font-family: Arial; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class=""><img src="https://lh6.googleusercontent.com/jlaP8D2tHfXHmrx3_mmnA58N-I73hYMU3-salgha0iJ4iPs-QSWh2aD42e3Z1lRnLOwFKI8Gj40xuTty9BfRiePIaQyUQANEXAK5ITUIBrwH8V4DtOQ8EEDGFLqo6fe9hY1b-KJQ" width="167" height="83" style="border:none" class=""></span></div></td><td style="vertical-align:top;padding:5pt" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 14pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Florian Forster</span></div><div style="line-height: 1.8; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size:10pt;font-family:Lato,sans-serif;color:rgb(153,153,153);background-color:transparent;vertical-align:baseline;white-space:pre-wrap" class="">H e a d o f C A O S</span></div><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 10pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Phone: +41 79 956 39 01</span></div><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 10pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Web: </span><span style="font-size:10pt;font-family:Lato,sans-serif;background-color:transparent;vertical-align:baseline;white-space:pre-wrap" class=""><font class=""> <a href="http://www.caos.ch/" target="_blank" class="">www.caos.ch</a></font></span></div></td></tr></tbody></table></div></span></div></div></div></div></div></div></div><br class=""></div></div></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 25 Apr 2020 at 13:25, Aeneas Rekkas <<a href="mailto:aeneas@ory.sh" class="">aeneas@ory.sh</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word;line-break:after-white-space" class="">Hi,<div class=""><br class=""></div><div class="">we ( <a href="https://github.com/ory/hydra" target="_blank" class="">https://github.com/ory/hydra</a> ) are receiving use cases for an OP-Initiated that does not involve the user’s browser and cookies. A use case might be that we want to perform Back-Channel Logout when the user changes his/her password. Another example would be that a user is banned by an administrator which in turn should trigger OIDC Back-Channel Logout. Is there any guidance on how this should be designed/implemented? Maybe even with an API Spec?</div><div class=""><br class=""></div><div class="">Best</div><div class="">Aeneas</div></div>_______________________________________________<br class="">
general mailing list<br class="">
<a href="mailto:general@lists.openid.net" target="_blank" class="">general@lists.openid.net</a><br class="">
<a href="http://lists.openid.net/mailman/listinfo/openid-general" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-general</a><br class="">
</blockquote></div>
</blockquote></div></div>-- <br class=""><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><span class=""><br class=""><div dir="ltr" style="margin-left:0pt" class=""><table style="border:none;border-collapse:collapse" class=""><colgroup class=""><col width="198" class=""><col width="402" class=""></colgroup><tbody class=""><tr style="height:103pt" class=""><td style="vertical-align:top;padding:5pt" class=""><div style="line-height: 1.2; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 11pt; font-family: Arial; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class=""><img src="https://lh6.googleusercontent.com/jlaP8D2tHfXHmrx3_mmnA58N-I73hYMU3-salgha0iJ4iPs-QSWh2aD42e3Z1lRnLOwFKI8Gj40xuTty9BfRiePIaQyUQANEXAK5ITUIBrwH8V4DtOQ8EEDGFLqo6fe9hY1b-KJQ" width="167" height="83" style="border:none" class=""></span></div></td><td style="vertical-align:top;padding:5pt" class=""><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 14pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Florian Forster</span></div><div style="line-height: 1.8; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size:10pt;font-family:Lato,sans-serif;color:rgb(153,153,153);background-color:transparent;vertical-align:baseline;white-space:pre-wrap" class="">H e a d o f C A O S</span></div><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 10pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Phone: +41 79 956 39 01</span></div><div style="line-height: 1.38; margin-top: 0pt; margin-bottom: 0pt;" class=""><span style="font-size: 10pt; font-family: Lato, sans-serif; background-color: transparent; vertical-align: baseline; white-space: pre-wrap;" class="">Web: </span><span style="font-size:10pt;font-family:Lato,sans-serif;background-color:transparent;vertical-align:baseline;white-space:pre-wrap" class=""><font class=""> <a href="http://www.caos.ch/" target="_blank" class="">www.caos.ch</a></font></span></div></td></tr></tbody></table></div></span></div></div></div></div></div></div>
</div></blockquote></div><br class=""></div></body></html>