<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.gmail-gmail-gmail-gmail-msonormal, li.gmail-gmail-gmail-gmail-msonormal, div.gmail-gmail-gmail-gmail-msonormal
{mso-style-name:gmail-gmail-gmail-gmail-msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:316763035;
mso-list-type:hybrid;
mso-list-template-ids:2144479820 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Worried about
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Timestamps<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Event versioning<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Schema for the actual event<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></a></p>
<span style="mso-bookmark:_MailEndCompose"></span>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-ab [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>William Denniss<br>
<b>Sent:</b> Friday, April 8, 2016 8:11 AM<br>
<b>To:</b> Mike Jones <Michael.Jones@microsoft.com><br>
<b>Cc:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-ab] Back-Channel Logout Token Proposal<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks for pointing this out Mike, that's correct.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thinking a little more about this, we probably keep the session-id claim ("sid") as a standard JWT claim, as it is useful in many places (e.g. ID Tokens), so perhaps a better logout token format would be:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">{<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "iss": "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fserver.example.com&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=aUQzmwc6oZB9Prj%2b3uGevJHxpLAyruxvsI17RCuOViw%3d">https://server.example.com</a>",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "aud": "s6BhdRkqt3",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "sub": "248289761001",<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "iat": 1458668180,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "exp": 1458668580,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "events": [<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> ],<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If we had additional standard logout-specific attributes we could put them in the "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>"
claim as per my previous example, but for simple events like this, that attribute dictionary may not be needed.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Effectivly the delta would then just be replacing <span style="font-family:"Courier New"">
"logout_only":"true"</span>, with <span style="font-family:"Courier New"">"events": [</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New""> "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>"</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Courier New""> ],</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">On Thu, Apr 7, 2016 at 7:03 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060">I’ll note that the “events” syntax below is based on Phil Hunt’s ID Events proposal, which William has been working on with him. See
the id-event mailing list for more details. The announcement of the id-event mailing list is at
<a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fwww.ietf.org%2fmail-archive%2fweb%2fietf-announce%2fcurrent%2fmsg14839.html&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=KxLkDmjsLgMc6u3lPoOiAPv9KZrOkwCymWQ4PLoQ6oc%3d">
http://www.ietf.org/mail-archive/web/ietf-announce/current/msg14839.html</a>.</span><o:p></o:p></p>
<p class="gmail-gmail-gmail-gmail-msonormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> </span><o:p></o:p></p>
<p class="gmail-gmail-gmail-gmail-msonormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> -- Mike</span><o:p></o:p></p>
<p class="gmail-gmail-gmail-gmail-msonormal"><a name="m_-8254563759309793909__MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#002060"> </span></a><o:p></o:p></p>
<p class="gmail-gmail-gmail-gmail-msonormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-ab [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>William Denniss<br>
<b>Sent:</b> Thursday, April 7, 2016 6:46 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] Back-Channel Logout Token Proposal</span><o:p></o:p></p>
<div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> <o:p></o:p></p>
<div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal">I had a discussion with Mike, John and Nat about event JWT formats at IETF95, specifically as they relate to the Back-Channel Logout spec.<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal">Here is an example of what the Back-Channel Logout Token could look like with an extensible event treatment:<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> {<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "iss": "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fserver.example.com&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=aUQzmwc6oZB9Prj%2b3uGevJHxpLAyruxvsI17RCuOViw%3d">https://server.example.com</a>",<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "aud": "s6BhdRkqt3",<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "sub": "248289761001",<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "iat": 1458668180,<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "exp": 1458668580,<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "events": [<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>"<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> ],<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>":
{<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02"<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> }<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> }<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> <o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal">The proposed change is replacing the "logout_only" claim in the
<a href="https://na01.safelinks.protection.outlook.com/?url=http%3a%2f%2fopenid.net%2fspecs%2fopenid-connect-backchannel-1_0.html%23LogoutToken&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=gt5SQ0QUDgvHS8FNda%2fa036Z4fLrN12pQ8ntuTXFXh4%3d">
current draft</a> with an "events" claim, a list of event type URI references. Each of these event type URIs is also a claim of its own, containing the event-specific attributes. The Back-Channel Logout spec would register just 1 event type: "<a href="https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fspecs.openid.net%2flogout&data=01%7c01%7ctonynad%40microsoft.com%7ccf1f679a591c4627f17a08d35fbffebf%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=DXNkm7Q2%2fg9AnUgTWa9xLCpiXEiNW9G8%2baxsLWG1I2I%3d">https://specs.openid.net/logout</a>",
and the "sid" attribute would move to the logout attribute group.<o:p></o:p></p>
</div>
<div>
<p class="gmail-gmail-gmail-gmail-msonormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>