[Openid-specs-ab] Possible state parameter for RP-initiated logout

[Todd W Lainhart]

We were planning on adding something like this for the same reasons given 
by Thomas.





Todd Lainhart
Rational software
IBM Corporation
550 King Street, Littleton, MA 01460-1250
1-978-899-4705
2-276-4705 (T/L)
lainhart at us.ibm.com




From:   Thomas Broyer <t.broyer at gmail.com>
To:     Mike Jones <Michael.Jones at microsoft.com>, 
Cc:     "openid-specs-ab at lists.openid.net" 
<openid-specs-ab at lists.openid.net>
Date:   07/01/2014 04:11 PM
Subject:        Re: [Openid-specs-ab] Possible state parameter for 
RP-initiated    logout
Sent by:        openid-specs-ab-bounces at lists.openid.net



That makes sense. Particularly given that all post_logout_redirect_uri 
should be pre-registered and are compared byte-for-byte, leaving no place 
to, e.g., add query-string arguments to customize the behavior upon 
redirection. So yes, there should be a 'state' parameter.

I'm going to add it to our implementation ASAP.


On Tue, Jul 1, 2014 at 2:31 AM, Mike Jones <Michael.Jones at microsoft.com> 
wrote:
Some Microsoft product people have requested an optional “state” parameter 
for RP-initiated logout requests.  Like the OAuth “state” parameter this 
would be passed to the end_session_endpoint as an optional query 
parameter, and if present, would be passed back with the same value to the 
post_logout_redirect_uri endpoint.
 
What do people think of this proposal?
 
RP-initiated logout is defined at 
http://openid.net/specs/openid-connect-session-1_0.html#RPLogout.
 
                                                                -- Mike
 

_______________________________________________
Openid-specs-ab mailing list
Openid-specs-ab at lists.openid.net
http://lists.openid.net/mailman/listinfo/openid-specs-ab




-- 
Thomas Broyer
/tɔ.ma.bʁwa.je/ _______________________________________________
Openid-specs-ab mailing list
Openid-specs-ab at lists.openid.net
http://lists.openid.net/mailman/listinfo/openid-specs-ab


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20140702/84b631c8/attachment.html>