<div dir="ltr">Thanks for pointing this out Mike, that's correct.<div><br></div><div>Thinking a little more about this, we probably keep the session-id claim ("sid") as a standard JWT claim, as it is useful in many places (e.g. ID Tokens), so perhaps a better logout token format would be:</div><div><br></div><div><div>{</div><div> "iss": "<a href="https://server.example.com">https://server.example.com</a>",</div><div> "aud": "s6BhdRkqt3",</div><div> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</div><div> "sub": "248289761001",</div><div> "iat": 1458668180,</div><div> "exp": 1458668580,</div><div> "events": [</div><div> "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>"</div><div> ],</div><div> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02"</div><div>}</div><div><br></div><div>If we had additional standard logout-specific attributes we could put them in the "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>" claim as per my previous example, but for simple events like this, that attribute dictionary may not be needed.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Effectivly the delta would then just be replacing <font face="monospace, monospace">"logout_only":"true"</font>, with <font face="monospace, monospace">"events": [</font></div><div><font face="monospace, monospace"> "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>"</font></div><div><font face="monospace, monospace"> ],</font></div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div class="gmail_quote">On Thu, Apr 7, 2016 at 7:03 PM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US">
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(0,32,96)">I’ll note that the “events” syntax below is based on Phil Hunt’s ID Events proposal, which William has been working on with him. See the id-event mailing list
for more details. The announcement of the id-event mailing list is at <a href="http://www.ietf.org/mail-archive/web/ietf-announce/current/msg14839.html">
http://www.ietf.org/mail-archive/web/ietf-announce/current/msg14839.html</a>.<u></u><u></u></span></p>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(0,32,96)"><u></u> <u></u></span></p>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(0,32,96)"> -- Mike<u></u><u></u></span></p>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><a name="m_-8254563759309793909__MailEndCompose"><span style="font-size:11pt;font-family:calibri,sans-serif;color:rgb(0,32,96)"><u></u> <u></u></span></a></p>
<span></span>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><b><span style="font-size:11pt;font-family:calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:calibri,sans-serif"> Openid-specs-ab [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>William Denniss<br>
<b>Sent:</b> Thursday, April 7, 2016 6:46 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] Back-Channel Logout Token Proposal<u></u><u></u></span></p><div><div class="gmail-gmail-gmail-gmail-h5">
<p class="gmail-gmail-gmail-gmail-MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal">I had a discussion with Mike, John and Nat about event JWT formats at IETF95, specifically as they relate to the Back-Channel Logout spec.<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal">Here is an example of what the Back-Channel Logout Token could look like with an extensible event treatment:<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> {<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "iss": "<a href="https://server.example.com">https://server.example.com</a>",<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "aud": "s6BhdRkqt3",<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "sub": "248289761001",<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "iat": 1458668180,<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "exp": 1458668580,<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "events": [<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>"<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> ],<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>": {<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02"<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"> }<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal">The proposed change is replacing the "logout_only" claim in the
<a href="http://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken">
current draft</a> with an "events" claim, a list of event type URI references. Each of these event type URIs is also a claim of its own, containing the event-specific attributes. The Back-Channel Logout spec would register just 1 event type: "<a href="https://specs.openid.net/logout">https://specs.openid.net/logout</a>",
and the "sid" attribute would move to the logout attribute group.<u></u><u></u></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br></div></div></div>