<font size=2 face="sans-serif">> </font><font size=2 color=#004080 face="Calibri"> Am
I correct or wrong that this is the same issue?</font>
<br>
<br><font size=2 face="sans-serif">It is the same issue. My sense
at the time it was closed was that folks on the call didn't want to hold
up the specs for this, and so Nat proposed the extension route, with the
observation that the topic had been raised before. I'm also recalling
that maybe the Googlers had something to say about this.</font>
<br>
<br><font size=2 face="sans-serif">> </font><font size=2 color=#004080 face="Calibri">is
there a reason that RPs can’t learn of the OP-initiated logout via the
JavaScript session state changed notification already in the spec?</font>
<br>
<br><font size=2 face="sans-serif">I'm not speaking for Pedro, but I'll
give you an example (but real) scenario that prompted #916. Browser
is viewing the protected resources of RP "A" (a session has already
been started). Bob clicks a link on the page which now shows the
representation of a protected resource from RP "B". Bob
selects "logout", which directs "B" to the end_session
endpoint. Ideally, "A" would get notified of the session
end so that it can drop resources that it was associating to Bob.</font>
<br>
<table width=223 style="border-collapse:collapse;">
<tr height=8>
<td width=223 bgcolor=white style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=1 face="Verdana"><b><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</b></font><font size=1 face="Arial"><b><br>
1-978-899-4705<br>
2-276-4705 (T/L)<br>
lainhart@us.ibm.com</b></font></table>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Mike Jones <Michael.Jones@microsoft.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">George Fletcher <gffletch@aol.com>,
Pedro Felix <pmhsfelix@gmail.com>, Justin Richer <jricher@mitre.org>,
</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">"openid-specs-ab@lists.openid.net"
<openid-specs-ab@lists.openid.net></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">03/13/2014 02:47 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [Openid-specs-ab]
Session cleanup via back-channel</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">openid-specs-ab-bounces@lists.openid.net</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 color=#004080 face="Calibri">Maybe I’m confused, but
this issue seems like a duplicate of </font><a href=https://bitbucket.org/openid/connect/issue/916><font size=2 color=blue face="Calibri"><u>https://bitbucket.org/openid/connect/issue/916</u></font></a><font size=2 color=#004080 face="Calibri">,
which we’d previously discussed and decided not to fix. Am I correct
or wrong that this is the same issue?</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">Responding to Pedro’s point
“</font><font size=3 face="Times New Roman">2) The OP propagate this cleanup
notification to the downstream RPs, also via back-channel (a back-channel
to front-channel is not possible)</font><font size=2 color=#004080 face="Calibri">”
– is there a reason that RPs can’t learn of the OP-initiated logout via
the JavaScript session state changed notification already in the spec?
I realize that requiring JavaScript might not be your preferred mechanism,
but we’ve also tried not to have multiple ways to do the same thing, unless
there’s a good reason to do so. I’m open-minded about this, but
would like to hear what the arguments for the additional mechanism are,
and if they’re different than those discussed with issue #916.</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">I’m also confused about
the talk of structured access tokens. How do structured access tokens
relate to logout? And why would we consider changing access tokens
from being opaque to structured? Requiring specific structure would
break many OAuth and OpenID Connect implementations.</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">I’m also confused why introspection
is being discussed again. We deleted the Check ID Endpoint, which
did introspection on ID Tokens in May 2012 in response to developer feedback
about not wanting to have to support two ways of doing the same thing.
See </font><a href=https://bitbucket.org/openid/connect/issue/570><font size=2 color=blue face="Calibri"><u>https://bitbucket.org/openid/connect/issue/570</u></font></a><font size=2 color=#004080 face="Calibri">.
Why is this being discussed again, now that the specs are final?</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">I guess call me confused
today…</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 color=#004080 face="Calibri">
-- Mike</font>
<br><font size=2 color=#004080 face="Calibri"> </font>
<br><font size=2 face="Tahoma"><b>From:</b> openid-specs-ab-bounces@lists.openid.net
[</font><a href="mailto:openid-specs-ab-bounces@lists.openid.net"><font size=2 face="Tahoma">mailto:openid-specs-ab-bounces@lists.openid.net</font></a><font size=2 face="Tahoma">]
<b>On Behalf Of </b>George Fletcher<b><br>
Sent:</b> Thursday, March 13, 2014 8:19 AM<b><br>
To:</b> Pedro Felix; Justin Richer<b><br>
Cc:</b> openid-specs-ab@lists.openid.net<b><br>
Subject:</b> Re: [Openid-specs-ab] Session cleanup via back-channel</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="sans-serif">Hi Pedro,<br>
<br>
Sorry for confusing the thread. I was responding to Nat's point about structured
headers. It's not really relevant to the issue you are addressing. As for
requirements for the back-channel call, you can add a document on the wiki,
or file a new issue on the site as an enhancement for the working group
to address and then put in the ticket all the current requirements. Others
can then comment on the ticket and the working group can track it.<br>
<br>
Note, that for this back-channel capability to be relevant to an RP, the
RP must support the concept of "server side" sessions (or maintain
a "black list" of revoked sessions). This doesn't tend to be
capabilities that most RPs support.<br>
<br>
Thanks,<br>
George</font>
<br><font size=3 face="Times New Roman">On 3/13/14 11:12 AM, Pedro Felix
wrote:</font>
<br><font size=3 face="Times New Roman">1) Since I'm rather new in this
group, what would be the best way to continue this discussion? In this
email thread? By trying to produce a requirements doc on the wiki? </font>
<br><font size=3 face="Times New Roman">Most probably, I will be working
on an implementation of this feature in the near future.</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">2) Picking up on Justin's reply:
an approach would be to also use the "aud" and the "sub"
to identify the session to cleanup. I don't like the idea of requiring
a round-trip to the introspection endpoint in order to check the token
purpose. Makes sense?</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">Thanks</font>
<br><font size=3 face="Times New Roman">Pedro</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">On Thu, Mar 13, 2014 at 2:12 PM,
Justin Richer <</font><a href=mailto:jricher@mitre.org target=_blank><font size=3 color=blue face="Times New Roman"><u>jricher@mitre.org</u></font></a><font size=3 face="Times New Roman">>
wrote:</font>
<br><font size=3 face="Times New Roman">A number of our apps use this combined
approach -- the server sends out a signed JWT that the client can check
the "iss" field and signature, then (if it cares to do so) the
client does introspection with the server at "iss" to see if
the token's still valid and what it's good for.</font><font size=3 color=#8f8f8f face="Times New Roman"><br>
<br>
-- Justin</font><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">On 03/13/2014 09:48 AM, George
Fletcher wrote:</font>
<br><font size=3 face="sans-serif">On the "structured token"
side of things I remember having a discussion about this at IIW (a few
back) and I thought someone and written something up. It was needed in
a number of cases that were using the token introspection endpoint as a
way to identifier the authorization server to send the token to for introspection.
I can't find my notes on the conversation but maybe someone else remembers?<br>
<br>
I think conceptually it was as simple as a non-signed JWT containing iss
and token fields. Obviously, the rest of JOSE could be applied for signed
or encrypted tokens.<br>
<br>
Thanks,<br>
George</font>
<br><font size=3 face="Times New Roman">On 3/12/14 9:02 PM, n-sakimura
wrote:</font>
<br><font size=3 face="Times New Roman">Let's just write up requirements
on the WG wiki (@bitbucket). <br>
Once we agree on the requirements, it should be straight forward to turn
it into a spec. <br>
<br>
On the side note, perhaps it is actually for OAuth WG, but it would be
nice to spec out the structured (access) token. it could be pseudo opaque
as well as long as you can find the authorization server from the token
but we at least need to be able to find out the iss. <br>
<br>
Nat <br>
<br>
(2014/03/13 3:58), John Bradley wrote: <br>
</font>
<br><font size=3 face="Times New Roman">We have discussed creating a backchannel
push method for the IdP to notify the RP. <br>
<br>
So far noting is written up. I have a bad feeling that it might be
me that needs to create the first draft. <br>
<br>
John B. <br>
<br>
On Mar 12, 2014, at 3:54 PM, Pedro Felix </font><a href=mailto:pmhsfelix@gmail.com target=_blank><font size=3 color=blue face="Times New Roman"><u><pmhsfelix@gmail.com></u></font></a><font size=3 face="Times New Roman">
wrote: <br>
<br>
</font>
<br><font size=3 face="Times New Roman">Hi, <br>
<br>
I've a scenario where a OIDC OP is acting as a bridge between upstream
IdPs using non-OIDC protocols (e.g Shibboleth) and downstream RPs using
OIDC. <br>
In this scenario I have the following requirements <br>
1) The upstream IdP notifies the OP of a session termination via
back-channel <br>
2) The OP propagate this cleanup notification to the downstream
RPs, also via back-channel (a back-channel to front-channel is not possible)
<br>
<br>
Unfortunately, the OIDC session management spec does not provide any way
to perform this back-channel cleanup, however I remember reading some meeting
notes about this possibility. <br>
<br>
Is there anything that can be shared? I would like to align our solution
with what is being developed by this working group. <br>
<br>
Thanks <br>
Pedro <br>
_______________________________________________ <br>
Openid-specs-ab mailing list </font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="mailto:Openid-specs-ab@lists.openid.net" target=_blank><font size=3 color=blue face="Times New Roman"><u>Openid-specs-ab@lists.openid.net</u></font></a><font size=3 face="Times New Roman">
</font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target=_blank><font size=3 color=blue face="Times New Roman"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a><font size=3 face="Times New Roman">
</font>
<br><font size=3 face="Times New Roman"><br>
<br>
<br>
_______________________________________________ <br>
Openid-specs-ab mailing list </font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="mailto:Openid-specs-ab@lists.openid.net" target=_blank><font size=3 color=blue face="Times New Roman"><u>Openid-specs-ab@lists.openid.net</u></font></a><font size=3 face="Times New Roman">
</font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target=_blank><font size=3 color=blue face="Times New Roman"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a><font size=3 face="Times New Roman">
</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">-- </font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href=http://connect.me/gffletch target=_blank><img src=cid:_4_0A8CD8B40A8CD4F400697C5D85257C9A alt="George Fletcher"></a>
<br><font size=3 face="Times New Roman"><br>
</font>
<br><font size=2 face="Courier New">_______________________________________________</font>
<br><font size=2 face="Courier New">Openid-specs-ab mailing list</font>
<br><a href="mailto:Openid-specs-ab@lists.openid.net" target=_blank><font size=2 color=blue face="Courier New"><u>Openid-specs-ab@lists.openid.net</u></font></a>
<br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target=_blank><font size=2 color=blue face="Courier New"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"><br>
_______________________________________________<br>
Openid-specs-ab mailing list</font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="mailto:Openid-specs-ab@lists.openid.net"><font size=3 color=blue face="Times New Roman"><u>Openid-specs-ab@lists.openid.net</u></font></a><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target=_blank><font size=3 color=blue face="Times New Roman"><u>http://lists.openid.net/mailman/listinfo/openid-specs-ab</u></font></a>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=3 face="Times New Roman">-- </font><font size=3 color=blue face="Times New Roman"><u><br>
</u></font><a href=http://connect.me/gffletch><img src=cid:_4_0A8C17DC0A8C146000697C5D85257C9A alt="George Fletcher"></a><tt><font size=2>_______________________________________________<br>
Openid-specs-ab mailing list<br>
Openid-specs-ab@lists.openid.net<br>
</font></tt><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab"><tt><font size=2>http://lists.openid.net/mailman/listinfo/openid-specs-ab</font></tt></a><tt><font size=2><br>
</font></tt>
<br>