<p dir="ltr">No disagreement with proposed language.</p>
<div class="gmail_quote">On May 24, 2013 7:20 PM, "Mike Jones" <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="color:#1f497d">My main point is that we should probably say that in some implementations “changed” events will occur only when changes to the user’s session occur whereas in other implementations, they may also occur as a result
of changes to other sessions between the user agent and the OP as well, and that RPs should be prepared for either eventuality. Any disagreement with that?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> John Bradley [mailto:<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>]
<br>
<b>Sent:</b> Friday, May 24, 2013 7:07 PM<br>
<b>To:</b> Nat Sakimura<br>
<b>Cc:</b> Mike Jones; <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>; Naveen Agarwal<br>
<b>Subject:</b> Re: [Openid-specs-ab] Another session management question: Per-user session state change notifications<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I seem to recall that there were issues with tracking them separately and changing state when any user in the browser logged in or out of the idp was going to be simpler for the IdP.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Remember we want people to build it, so simplicity and reliability count.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I am guessing that some browsers like Chrome which have a notion of personas with logged in sessions might be able to do a better job of separating the sessions.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">John B.<u></u><u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On 2013-05-24, at 7:19 PM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">If Alice and Bob are different entities, they should be independent. <br>
<br>
=nat<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
May 25, 2013 6:52<span lang="JA" style="font-family:"MS PGothic","sans-serif"">¡¢</span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>>
<span lang="JA" style="font-family:"MS PGothic","sans-serif"">¤Î¥á¥Ã¥»©`¥¸</span>:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Another one for you, Breno and Naveen…<u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif""> <u></u><u></u></span></p>
</div>
<p class="MsoNormal">Assume Alice and Bob are both have sessions within the same user agent at the same RP using the same OP. Currently, the session management spec assumes that session state notifications caused by changes to either of Alice’s or Bob’s session
will cause “changed” notifications to be sent to both of them, correct? Developers I’m speaking with are saying that they’d like it to be legal for Alice to only be notified of changes caused by her session and for Bob to only be notified of changes caused
by his session. This would cut down on the number of false positives, which result in unnecessary “prompt”: “none” reauthentication requests.<u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif""> <u></u><u></u></span></p>
</div>
<p class="MsoNormal">Is there any reason not to say that legal implementations may do this? Or is there some technical reason that Alice MUST always be made aware of changes to Bob’s session, and vice versa? Might it be that there’s no way of knowing who’s
asking within the user agent, and so both have to be notified of changes caused by either?<u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif""> <u></u><u></u></span></p>
</div>
<p class="MsoNormal"> Thanks all,<u></u><u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif""> <u></u><u></u></span></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif"">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif"">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"MS PGothic","sans-serif""><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
<br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div>