<html><head></head><body>Hi Todd,<br>
<br>
this page would not necessarily have a client id.<br>
<br>
Regards,<br>
Torsten.<br><br><div class="gmail_quote"><br>
<br>
Todd W Lainhart <lainhart@us.ibm.com> schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<font size="2" face="sans-serif">Hi Torsten -</font>
<br />
<br /><font size="2" face="sans-serif">> </font><font size="3">We see the
need to trigger a logout from pages, which did not previously process a
login (portal, landing page).</font>
<br />
<br /><font size="2" face="sans-serif">Would your page have a client_id available?
It's a requirement that the provided post_logout_uri be registered.
I was trying to intuit how that would be done given the current param
spec, in which the client_id was only available (perhaps) as the "aud"
field of the id_token.<br />
</font>
<br />
<table width="223" style="border-collapse:collapse;"><tbody><tr height="8"><td width="223" bgcolor="white" style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size="1" face="Verdana"><b><br />
<br />
<br />
Todd Lainhart<br />
Rational software<br />
IBM Corporation<br />
550 King Street, Littleton, MA 01460-1250</b></font><font size="1" face="Arial"><b><br />
1-978-899-4705<br />
2-276-4705 (T/L)<br />
lainhart@us.ibm.com</b></font></td></tr></tbody></table>
<br />
<br />
<br />
<br />
<br /><font size="1" color="#5f5f5f" face="sans-serif">From:
</font><font size="1" face="sans-serif">Torsten Lodderstedt
<torsten@lodderstedt.net></font>
<br /><font size="1" color="#5f5f5f" face="sans-serif">To:
</font><font size="1" face="sans-serif">Todd W Lainhart/Lexington/IBM@IBMUS,
</font>
<br /><font size="1" color="#5f5f5f" face="sans-serif">Cc:
</font><font size="1" face="sans-serif">"openid-specs-ab@lists.openid.net"
<openid-specs-ab@lists.openid.net></font>
<br /><font size="1" color="#5f5f5f" face="sans-serif">Date:
</font><font size="1" face="sans-serif">01/18/2014 03:44 AM</font>
<br /><font size="1" color="#5f5f5f" face="sans-serif">Subject:
</font><font size="1" face="sans-serif">Re: [Openid-specs-ab]
end_session endpoint parameter specs</font>
<br />
<hr noshade="noshade" />
<br />
<br />
<br /><font size="3">Hi Todd,</font>
<br />
<br /><font size="3">I think your proposal to make the id token hint required
if the post logout uri is present limits applicability of the logout mechanism.
We see the need to trigger a logout from pages, which did not previously
process a login (portal, landing page). This would be impossible.</font>
<br />
<br /><font size="3">General note: I think the security consideration section
must discuss open redirection at the end session endpoint. I assume registration
of post logout uri serves the purpose of preventing this threat but this
is not documented.</font>
<br />
<br /><font size="3">regards,</font>
<br /><font size="3">Torsten.</font>
<br /><font size="3"><br />
Am 17.01.2014 um 22:45 schrieb Todd W Lainhart <</font><a href="mailto:lainhart@us.ibm.com"><font size="3" color="blue"><u>lainhart@us.ibm.com</u></font></a><font size="3">>:<br />
</font>
<br /><font size="2" face="sans-serif">Last week I filed:</font><font size="3">
<br />
</font><font size="3" color="blue"><u><br />
</u></font><a href="https://bitbucket.org/openid/connect/issue/914/session-5-missing-client_id-parameter"><tt><font size="2" color="blue"><u>https://bitbucket.org/openid/connect/issue/914/session-5-missing-client_id-parameter</u></font></tt></a><font size="3">
<br />
</font><font size="2" face="sans-serif"><br />
...where I stated that a required client_id parm was missing that allowed
for the verification of the post_logout_uri value. I've implemented
this endpoint, and I think that I see that this parm may not be necessary.</font><font size="3">
<br />
</font><font size="2" face="sans-serif"><br />
Section 5 of the session mgmt. spec says this:</font><font size="3"> <br />
</font><font size="2" face="sans-serif"><br />
//===========</font><font size="3"> </font><font size="2" face="Verdana"><br />
This specification also defines the following parameters that are passed
as query parameters in the logout request:</font><font size="3"> </font>
<p><font size="2" face="Verdana">id_token_hint</font><font size="3"> </font><font size="2" face="Verdana"><br />
RECOMMENDED. Previously issued ID Token passed to the logout endpoint as
a hint about the End-User's current authenticated session with the Client.
This is used as an indication of the identity of the End-User that the
RP is requesting be logged out by the OP. The OP need not be listed as
an audience of the ID Token when it is used as an </font><font size="2" color="#002060" face="Courier New">id_token_hint</font><font size="2" face="Verdana">
value.</font><font size="3"> </font><font size="2" face="Verdana"><br />
post_logout_redirect_uri</font><font size="3"> </font><font size="2" face="Verdana"><br />
OPTIONAL. URL to which the RP is requesting that the End-User's User Agent
be redirected after a logout has been performed. The value MUST have been
previously registered with the OP, either using the </font><font size="2" color="#002060" face="Courier New">post_logout_redirect_uris</font><font size="2" face="Verdana">
Registration parameter or via another mechanism. If supplied, the OP SHOULD
honor this request following the logout.</font><font size="3"> </font><font size="2" face="sans-serif"><br />
</font><font size="3"><br />
</font><font size="2" face="sans-serif"><br />
//===========</font><font size="3"> <br />
</font><font size="2" face="sans-serif"><br />
I would reword these definitions to say something along the following lines:</font><font size="3">
<br />
</font><font size="2" face="sans-serif"><br />
post_logout_redirect_uri OPTIONAL. The URL to which the RP
is requesting that the End-User's User Agent be redirected to after the
logout has been performed. The value MUST have been previously registered
with the OP, either using the post_logout_redirect_uris Registration parameter
or via another mechanism. If supplied, id_token_hint MUST be specified.</font><font size="3">
<br />
</font><font size="2" face="sans-serif"><br />
id_token_hint REQUIRED if "post_logout_redirect_uri" is specified,
otherwise RECOMMENDED. The previously issued ID Token passed to the
logout endpoint as a hint about the End-User's current authenticated session
with the Client. This is used as an indication of the identity of the End-User
that the RP is requesting be logged out by the OP. If "post_logout_redirect_uri"
is specified, then the "aud" member of this token MUST be a single
element, and MUST be the client_id to which the specified "post_logout_redirect_uri"
is registered.</font><font size="3"> <br />
</font><font size="2" face="sans-serif"><br />
Additionally, a decision should be made as to whether a state parameter
should be included that can be round-tripped via the post_logout_redirect_uri.
Either that, or the value of the id_token_hint parm is returned via
the post_logout_redirect_uri redirect.</font><font size="3"> <br />
</font><font size="2" face="sans-serif"><br />
The implication of this is that the end_session_endpoint can be called
with no parameters, an id_token_hint, or both id_token_hint and post_logout_redirect_uri.</font><font size="3">
</font>
</p><p>
<table width="223" style="border-collapse:collapse;"><tbody><tr height="8"><td width="221" bgcolor="white" style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size="3"><br />
<br />
</font><font size="1" face="Verdana"><b><br />
<br />
<br />
<br />
Todd Lainhart<br />
Rational software<br />
IBM Corporation<br />
550 King Street, Littleton, MA 01460-1250</b></font><font size="1" face="Arial"><b><br />
1-978-899-4705<br />
2-276-4705 (T/L)</b></font><font size="1" color="blue" face="Arial"><b><u><br />
</u></b></font><a href="mailto:lainhart@us.ibm.com"><font size="1" color="blue" face="Arial"><b><u>lainhart@us.ibm.com</u></b></font></a></td></tr></tbody></table>
<br />
<br /><font size="3">_______________________________________________<br />
Openid-specs-ab mailing list</font><font size="3" color="blue"><u><br />
</u></font><a href="mailto:Openid-specs-ab@lists.openid.net"><font size="3" color="blue"><u>Openid-specs-ab@lists.openid.net</u></font></a><font size="3" color="blue"><u><br />
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab"><font size="3" color="blue"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a>
<br /></p></blockquote></div></body></html>