<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">In the current session management spec the session_management parameter is used to prevent correlation, or information leaking to third parties invoking the API.<div><br></div><div>I suppose that depending how the IdP crates the value it could be unique enough to identify the session, though I don't think that is guaranteed by the current spec.</div><div><br></div><div>An IdP might support the logout api but not the rest of the JS session management, in that case there wouldn't be a session_state to send.</div><div><br></div><div>Sending the id_token_hint is not required, but is probably a good idea if the IdP supports multiple logins. </div><div><br></div><div>I think trying to use it in place of the id_token_hint is more of a stretch. The id_token_hint is required when you are trying to log someone in again as the same account after the session has expired. So adding another hint beyond the id_token and login_hint may cause more confusion than it is worth.</div><div><br></div><div>I am happy to discuss the idea if you like.</div><div><br></div><div>The Google folks should chime in on if this would fit the design of the parameter or if the parameter was just intended to provide entropy and not be unique.</div><div><br></div><div>John B.</div><div><br></div><div><br><div><br></div><div><br></div><div><div><div>On Jun 30, 2014, at 8:46 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Some Microsoft product people have asked whether session_state could be used in logout requests as an alternative to using the id_token_hint. A secondary related ask would be to be able to use the session_state instead of id_token_hint in prompt=none requests.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">The logic behind this request is that then the RP would only need to persist the session_state value and not the id_token value.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">It's not clear whether in the general case, session_state would have sufficient information for this to work. It would be good to get a sense what people have in their session_state values now (which are opaque to the RP).<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Another possible downside to this is that since session management is optional, RPs would still have to have code to persist the id_token for prompt=none requests for OPs that don’t support session management.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Comments?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> -- Mike<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></blockquote></div><br></div></div></body></html>