<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";
color:#003366;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks for pointing out the typos, Thomas. I was writing that text apparently too quickly. I’ll correct it!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You’re right that Session Management is about state change but the primary state change reacted to by the RP is logout. That’s why the next-to-last paragraph
in the RP iframe section at <a href="http://openid.net/specs/openid-connect-session-1_0.html#RPiframe">
http://openid.net/specs/openid-connect-session-1_0.html#RPiframe</a> says:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span lang="EN" style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">When the RP detects a session state change, it SHOULD first try a
</span><tt><span lang="EN" style="font-size:10.0pt">prompt=none</span></tt><span lang="EN" style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black"> request within an iframe to obtain a new ID Token and session state, sending the old ID Token
as the </span><tt><span lang="EN" style="font-size:10.0pt">id_token_hint</span></tt><span lang="EN" style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:black">. If the RP receives an ID token for the same End-User, it SHOULD simply update the
value of the session state. If it doesn't receive an ID token or receives an ID token for another End-User, then it needs to handle this case as a logout for the original End-User.</span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Both specs can do either RP- or OP-initiated logout. (The RP-initiated logout is the same in both.) In one, the OP communicates the logout message with a
GET (an HTTP action) and in the other with a postMessage (an HTML action). That’s why we chose the name – because there’s some differentiation based on the two mechanisms.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">The problem with the “browser-based logout” name is that the Session Management spec also facilitates browser-based logout. We were trying for a name that
differentiates the two specs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">We should probably continue talking about the name. Let’s add it as a topic to the Thursday working group call. Thomas – you’re free to join it. Join at
https://www3.gotomeeting.com/join/181372694 or +1 (646) 982-0002, access code 181-372-694 or see
<a href="https://global.gotomeeting.com/public/prelogin.html#meetings/181372694/numbersdisplay">
https://global.gotomeeting.com/public/prelogin.html#meetings/181372694/numbersdisplay</a> for more phone numbers. The call is at 7am US Pacific Time which would be 15:00 CET this week.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Thomas Broyer [mailto:t.broyer@gmail.com]
<br>
<b>Sent:</b> Monday, March 09, 2015 4:11 PM<br>
<b>To:</b> Mike Jones; mail@alfred-albrecht.net; openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-ab] First full HTML-based logout spec published<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Session Management is not about "logout", more about "state change" to trigger a re-auth and possibly get an error that will trigger a "logout at the RP" (or to put it differently, "end of session")<br>
The section about logout in Session Management is RP-Initiated logout at the OP, whereas this spec is OP-Initiated logout (end of session) at the RPs.<o:p></o:p></p>
<div>
<p class="MsoNormal">So "HTML-Based Logout" (as you mistyped almost everywhere: here, on your blog, on twitter, on the
<a href="http://openid.net">openid.net</a> web pages) would be much better than "HTTP-Based Logout" IMO (what part of OIDC is not HTTP to begin with?), or maybe "browser-based logout"? Or how about "OP-Initiated distributed logout", or something about "notifying
RPs of logout at the OP".<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Mar 9, 2015 at 6:15 PM Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">The title is currently "OpenID Connect HTTP-Based Logout 1.0". It's HTTP, because it's HTTP methods such as GET that trigger the logouts. If anything, the Session Management spec is really the one that's HTML-based logout, because it's
using HTML5 postMessage calls to do trigger the logouts. (We'd discussed that on the Thursday working group call, in fact.)<br>
<br>
People are encouraged to keep thinking about the naming. The current name is the best that the working group had come up with, to date, but a more compelling name would of course be great.<br>
<br>
-- Mike<br>
<br>
-----Original Message-----<br>
From: Openid-specs-ab [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>] On Behalf Of
<a href="mailto:mail@alfred-albrecht.net" target="_blank">mail@alfred-albrecht.net</a><br>
Sent: Saturday, March 07, 2015 12:32 AM<br>
To: <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
Subject: Re: [Openid-specs-ab] First full HTML-based logout spec published<br>
<br>
Would it make sense to rename the spec to "HTML-based logout"? Or do you plan to define more logout techniques?<br>
<br>
Furthermore it seems that logout_supported is now http_logout_supported.<br>
Maybe a typo.<br>
<br>
--<br>
Alfred<br>
<br>
Am 06.03.2015 um 08:25 schrieb Mike Jones:<br>
> The first full version of the HTML-based logout spec is now published<br>
> at <a href="http://openid.net/specs/openid-connect-logout-1_0.html" target="_blank">
http://openid.net/specs/openid-connect-logout-1_0.html</a>. It's also<br>
> listed on the Connect page at <a href="http://openid.net/connect/" target="_blank">
http://openid.net/connect/</a>, the working<br>
> group repository at <a href="http://openid.bitbucket.org/" target="_blank">http://openid.bitbucket.org/</a>, and the working<br>
> group page at <a href="http://openid.net/wg/connect/" target="_blank">http://openid.net/wg/connect/</a>.<br>
><br>
><br>
><br>
> Semantic changes based on feedback since the 24-Feb-15 version are:<br>
><br>
> * Removed the "iss" query parameter.<br>
><br>
> * Added an entropy requirement for "sid" values.<br>
><br>
> * Renamed "logout_supported" to "html_logout_supported".<br>
><br>
><br>
><br>
> -- Mike<br>
><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Openid-specs-ab mailing list<br>
> <a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
> <a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">
http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
><br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></p>
</div>
</div>
</body>
</html>