<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks for the concrete example, Todd. That’s useful. Your example seems to indicate that JavaScript code in pages present in the browser history doesn’t
get to run unless the page is the displayed page. Is that correct? And is the answer the same for all browsers or is it different for different browsers? (I’m not an expert in browser implementation details, so I’m openly asking this, hoping that someone
on the thread does have this expertise.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Do you have any sense why this issue also prompted discussions on non-opaque access tokens and introspection?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Todd W Lainhart [mailto:lainhart@us.ibm.com]
<br>
<b>Sent:</b> Thursday, March 13, 2014 12:12 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> George Fletcher; Justin Richer; openid-specs-ab@lists.openid.net; openid-specs-ab-bounces@lists.openid.net; Pedro Felix<br>
<b>Subject:</b> Re: [Openid-specs-ab] Session cleanup via back-channel<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">>
</span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> Am I correct or wrong that this is the same issue?</span>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif"">It is the same issue. My sense at the time it was closed was that folks on the call didn't want to hold up the specs for this, and so Nat proposed the extension route, with the observation that
the topic had been raised before. I'm also recalling that maybe the Googlers had something to say about this.</span>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif"">> </span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">is there a reason that RPs can’t learn of the OP-initiated logout via the JavaScript session state changed
notification already in the spec?</span> <br>
<br>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif"">I'm not speaking for Pedro, but I'll give you an example (but real) scenario that prompted #916. Browser is viewing the protected resources of RP "A" (a session has already been started). Bob
clicks a link on the page which now shows the representation of a protected resource from RP "B". Bob selects "logout", which directs "B" to the end_session endpoint. Ideally, "A" would get notified of the session end so that it can drop resources that it
was associating to Bob.</span> <o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="223" style="width:167.25pt;border-collapse:collapse">
<tbody>
<tr style="height:6.0pt">
<td width="223" style="width:167.25pt;border:solid black 1.0pt;background:white;padding:0in 0in 0in 0in;height:6.0pt">
<p class="MsoNormal" style="mso-line-height-alt:6.0pt"><b><span style="font-size:7.5pt;font-family:"Verdana","sans-serif""><br>
<br>
<br>
Todd Lainhart<br>
Rational software<br>
IBM Corporation<br>
550 King Street, Littleton, MA 01460-1250</span></b><b><span style="font-size:7.5pt;font-family:"Arial","sans-serif""><br>
1-978-899-4705<br>
2-276-4705 (T/L)<br>
<a href="mailto:lainhart@us.ibm.com">lainhart@us.ibm.com</a></span></b><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><br>
<br>
<br>
<br>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">From: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">To: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">George Fletcher <<a href="mailto:gffletch@aol.com">gffletch@aol.com</a>>, Pedro Felix <<a href="mailto:pmhsfelix@gmail.com">pmhsfelix@gmail.com</a>>,
Justin Richer <<a href="mailto:jricher@mitre.org">jricher@mitre.org</a>>, </span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Cc: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">"<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Date: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">03/13/2014 02:47 PM</span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Subject: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">Re: [Openid-specs-ab] Session cleanup via back-channel</span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Sent by: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif""><a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a></span>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" noshade="" style="color:#A0A0A0" align="center">
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">Maybe I’m confused, but this issue seems like a duplicate of
</span><a href="https://bitbucket.org/openid/connect/issue/916"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">https://bitbucket.org/openid/connect/issue/916</span></a><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">,
which we’d previously discussed and decided not to fix. Am I correct or wrong that this is the same issue?</span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">Responding to Pedro’s point “</span>2) The OP propagate this cleanup notification to the downstream RPs, also via back-channel (a back-channel to front-channel is not possible)<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">”
– is there a reason that RPs can’t learn of the OP-initiated logout via the JavaScript session state changed notification already in the spec? I realize that requiring JavaScript might not be your preferred mechanism, but we’ve also tried not to have multiple
ways to do the same thing, unless there’s a good reason to do so. I’m open-minded about this, but would like to hear what the arguments for the additional mechanism are, and if they’re different than those discussed with issue #916.</span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">I’m also confused about the talk of structured access tokens. How do structured access tokens relate to logout? And why would we consider changing access tokens from being opaque
to structured? Requiring specific structure would break many OAuth and OpenID Connect implementations.</span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">I’m also confused why introspection is being discussed again. We deleted the Check ID Endpoint, which did introspection on ID Tokens in May 2012 in response to developer feedback
about not wanting to have to support two ways of doing the same thing. See </span>
<a href="https://bitbucket.org/openid/connect/issue/570"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">https://bitbucket.org/openid/connect/issue/570</span></a><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">.
Why is this being discussed again, now that the specs are final?</span> <br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080">I guess call me confused today…</span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> -- Mike</span>
<br>
<span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#004080"> </span>
<br>
<b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a> [</span><a href="mailto:openid-specs-ab-bounces@lists.openid.net"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">mailto:openid-specs-ab-bounces@lists.openid.net</span></a><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">]
<b>On Behalf Of </b>George Fletcher<b><br>
Sent:</b> Thursday, March 13, 2014 8:19 AM<b><br>
To:</b> Pedro Felix; Justin Richer<b><br>
Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><b><br>
Subject:</b> Re: [Openid-specs-ab] Session cleanup via back-channel</span> <br>
<br>
<span style="font-family:"Arial","sans-serif"">Hi Pedro,<br>
<br>
Sorry for confusing the thread. I was responding to Nat's point about structured headers. It's not really relevant to the issue you are addressing. As for requirements for the back-channel call, you can add a document on the wiki, or file a new issue on the
site as an enhancement for the working group to address and then put in the ticket all the current requirements. Others can then comment on the ticket and the working group can track it.<br>
<br>
Note, that for this back-channel capability to be relevant to an RP, the RP must support the concept of "server side" sessions (or maintain a "black list" of revoked sessions). This doesn't tend to be capabilities that most RPs support.<br>
<br>
Thanks,<br>
George</span> <br>
On 3/13/14 11:12 AM, Pedro Felix wrote: <br>
1) Since I'm rather new in this group, what would be the best way to continue this discussion? In this email thread? By trying to produce a requirements doc on the wiki?
<br>
Most probably, I will be working on an implementation of this feature in the near future.
<br>
<br>
2) Picking up on Justin's reply: an approach would be to also use the "aud" and the "sub" to identify the session to cleanup. I don't like the idea of requiring a round-trip to the introspection endpoint in order to check the token purpose. Makes sense?
<br>
<br>
Thanks <br>
Pedro <br>
<br>
On Thu, Mar 13, 2014 at 2:12 PM, Justin Richer <<a href="mailto:jricher@mitre.org" target="_blank">jricher@mitre.org</a>> wrote:
<br>
A number of our apps use this combined approach -- the server sends out a signed JWT that the client can check the "iss" field and signature, then (if it cares to do so) the client does introspection with the server at "iss" to see if the token's still valid
and what it's good for.<span style="color:#8F8F8F"><br>
<br>
-- Justin</span> <br>
<br>
On 03/13/2014 09:48 AM, George Fletcher wrote: <br>
<span style="font-family:"Arial","sans-serif"">On the "structured token" side of things I remember having a discussion about this at IIW (a few back) and I thought someone and written something up. It was needed in a number of cases that were using the token
introspection endpoint as a way to identifier the authorization server to send the token to for introspection. I can't find my notes on the conversation but maybe someone else remembers?<br>
<br>
I think conceptually it was as simple as a non-signed JWT containing iss and token fields. Obviously, the rest of JOSE could be applied for signed or encrypted tokens.<br>
<br>
Thanks,<br>
George</span> <br>
On 3/12/14 9:02 PM, n-sakimura wrote: <br>
Let's just write up requirements on the WG wiki (@bitbucket). <br>
Once we agree on the requirements, it should be straight forward to turn it into a spec.
<br>
<br>
On the side note, perhaps it is actually for OAuth WG, but it would be nice to spec out the structured (access) token. it could be pseudo opaque as well as long as you can find the authorization server from the token but we at least need to be able to find
out the iss. <br>
<br>
Nat <br>
<br>
(2014/03/13 3:58), John Bradley wrote: <br>
<br>
We have discussed creating a backchannel push method for the IdP to notify the RP.
<br>
<br>
So far noting is written up. I have a bad feeling that it might be me that needs to create the first draft.
<br>
<br>
John B. <br>
<br>
On Mar 12, 2014, at 3:54 PM, Pedro Felix <a href="mailto:pmhsfelix@gmail.com" target="_blank">
<pmhsfelix@gmail.com></a> wrote: <br>
<br>
<br>
Hi, <br>
<br>
I've a scenario where a OIDC OP is acting as a bridge between upstream IdPs using non-OIDC protocols (e.g Shibboleth) and downstream RPs using OIDC.
<br>
In this scenario I have the following requirements <br>
1) The upstream IdP notifies the OP of a session termination via back-channel <br>
2) The OP propagate this cleanup notification to the downstream RPs, also via back-channel (a back-channel to front-channel is not possible)
<br>
<br>
Unfortunately, the OIDC session management spec does not provide any way to perform this back-channel cleanup, however I remember reading some meeting notes about this possibility.
<br>
<br>
Is there anything that can be shared? I would like to align our solution with what is being developed by this working group.
<br>
<br>
Thanks <br>
Pedro <br>
_______________________________________________ <br>
Openid-specs-ab mailing list <u><span style="color:blue"><br>
</span></u><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a>
<u><span style="color:blue"><br>
</span></u><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
<br>
<br>
<br>
<br>
_______________________________________________ <br>
Openid-specs-ab mailing list <u><span style="color:blue"><br>
</span></u><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a>
<u><span style="color:blue"><br>
</span></u><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
<br>
<br>
<br>
-- <u><span style="color:blue"><br>
</span></u><a href="http://connect.me/gffletch" target="_blank"><span style="text-decoration:none"><img border="0" width="359" height="113" id="_x0000_i1026" src="cid:image001.png@01CF3EB7.4D847F60" alt="George Fletcher"></span></a><br>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Courier New"">_______________________________________________</span>
<br>
<span style="font-size:10.0pt;font-family:"Courier New"">Openid-specs-ab mailing list</span>
<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank"><span style="font-size:10.0pt;font-family:"Courier New"">Openid-specs-ab@lists.openid.net</span></a>
<br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank"><span style="font-size:10.0pt;font-family:"Courier New"">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></a>
<br>
<br>
<br>
_______________________________________________<br>
Openid-specs-ab mailing list<u><span style="color:blue"><br>
</span></u><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><u><span style="color:blue"><br>
</span></u><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
<br>
<br>
<br>
-- <u><span style="color:blue"><br>
</span></u><a href="http://connect.me/gffletch"><span style="text-decoration:none"><img border="0" width="359" height="113" id="_x0000_i1027" src="cid:image002.png@01CF3EB7.4D847F60" alt="George Fletcher"></span></a><tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>Openid-specs-ab mailing list</tt><br>
<tt><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></tt><br>
</span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab"><tt><span style="font-size:10.0pt">http://lists.openid.net/mailman/listinfo/openid-specs-ab</span></tt></a><o:p></o:p></p>
</div>
</body>
</html>