<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst, p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle, p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style>
</head>
<body>
<div data-externalstyle="false" dir="ltr" style="font-family:Calibri,'Segoe UI',Meiryo,'Microsoft YaHei UI','Microsoft JhengHei UI','Malgun Gothic','Khmer UI','Nirmala UI',Tunga,'Lao UI',Ebrima,sans-serif;font-size:12pt;">
<div>You have this deployed now, right? How is this working in your deployment?</div>
<div> </div>
<div>So you’re suggesting that we use the id_token_hint parameter and pass the ID Token to the end_session_endpoint? What do others think of that?</div>
<div> </div>
<div>-- Mike</div>
<div data-signatureblock="true"> </div>
<div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid;">
<div><font face="Calibri, 'Segoe UI', Meiryo, 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'Khmer UI', 'Nirmala UI', Tunga, 'Lao UI', Ebrima, sans-serif" style="line-height: 15pt; letter-spacing: 0.02em; font-family: Calibri, "Segoe UI", Meiryo, "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "Khmer UI", "Nirmala UI", Tunga, "Lao UI", Ebrima, sans-serif; font-size: 11pt;"><b>From:</b> Breno
de Medeiros<br>
<b>Sent:</b> ýThursdayý, ýMayý ý23ý, ý2013 ý8ý:ý23ý ýPM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> Naveen Agarwal, openid-specs-ab@lists.openid.net</font></div>
</div>
<div> </div>
I think we should use the same approach as in the immediate flow,<br>
i.e., provide a hint about the intended user. In fact I had suggested<br>
the entire id_token be supplied to the OP.<br>
<br>
On Thu, May 23, 2013 at 6:48 PM, Mike Jones <Michael.Jones@microsoft.com> wrote:<br>
> Hi Breno and Naveen,<br>
><br>
><br>
><br>
> (1) Assume that two users (Alice and Bob) have sessions from the same RP<br>
> logged into to the same OP. Bob decides to log out. Per the session<br>
> management spec, Bob is logged out of the RP locally and then the RP<br>
> redirects to the OP’s end_session_endpoint. Does the OP also log Alice out<br>
> when Bob consents the logout action or just Bob? If Alice is not logged<br>
> out, how does the OP know which user to log out? Through Bob’s cookie? (I<br>
> think that this is the case, but wanted to verify it.)<br>
><br>
><br>
><br>
> At a minimum, we need to say what is expected to happen in this case in the<br>
> spec. It wasn’t clear to some developers reading it recently.<br>
><br>
><br>
><br>
> (2) In a related question, should we be passing an id_token as a parameter<br>
> to the logout URL so that the OP knows which session to log out? Or is this<br>
> already known, per the answer to (1)? Would adding this parameter enable<br>
> additional kinds of attacks?<br>
><br>
><br>
><br>
> Thanks,<br>
><br>
> -- Mike<br>
><br>
><br>
<br>
<br>
<br>
-- <br>
--Breno<br>
</div>
</body>
</html>