<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Notes for Connect call. Please let me know of any corrections.<div class=""><br class=""></div><div class=""><div class="">*Next working group call is on Thursday next week on Aug 18th at 7AM Pacific time.</div><div class=""><br class=""></div><div class=""><div class="">Attendance:</div><div class=""><br class=""></div><div class="">Nat Sakimura</div><div class="">John Bradley</div>George Fletcher<br class=""><div class="">Prateek Mishra</div><div class="">Phil Hunt</div><div class=""><div class=""><br class=""></div><div class="">Nat regarding agenda:</div><div class=""><br class=""></div><div class="">This conversation is in part a continuation of previous call (RISC) as well as EAP drafts. Backchannel and federation spec.</div><div class=""><br class=""></div><div class="">Nat: Any discussion on EAP drafts from last week?</div><div class=""> - the drafts were adopted and people were encouraged to read them according to Nat</div><div class="">No discussion.</div><div class=""><br class=""></div><div class="">Backchannel Logout and ID-Events Discussion.</div><div class=""><br class=""></div><div class="">Nat/John?: We have an issue where ID Tokens and JWTs have a lot of fuzzy overlap. Phil had previously pointed out that figuring out that something is not an ID Token is looking for the absence of something. Nat indicated he’s long advocated for token type field.</div><div class=""><br class=""></div><div class="">Should we keep using subject in an event, when it may not be the sub as defined by OpenID Connect? Further that the issuer may not be related to the issuer of the subject. One problem is that any field not understood by the parser would be ignored. Thus it might not be a good idea to re-use subject in the top level.</div><div class=""><br class=""></div><div class="">One idea is to leave sub out of the top level but have sub in the event specific data. “iss” can also be repeated. John suggested maybe it would be a good idea to rename the attribute. John mused maybe Mike meant use the id token format, but not literally use the id token.</div><div class=""><br class=""></div><div class="">Prateek: if you look at security event format, it is typically labelled as an observation. Does that distinguish from an ID Token?</div><div class=""><br class=""></div><div class="">Maybe the id-event envelope should just be an envelop. The individual event be left to define its claims. Separate the two layers. </div><div class=""><br class=""></div><div class="">John suggested, for logout we should avoid use of the term session and should use token revocation [as in revoke the id token].</div><div class=""><br class=""></div><div class="">John and Phil discussed if two event could be embedded in a message: e.g. a SCIM account reset and a RISC account reset, then each could have their own attributes and slightly different addressing in the same JWT. [It was not clear that this is a good thing. The general feeling was keep separate].</div><div class=""><br class=""></div><div class="">John and George discussed the different natures of logout/revocation. If you say revoke a token, is it based on a user action or a devops action? Are there differences in semantics? </div><div class=""><br class=""></div><div class="">In the front-channel you rarely want to say revoke this session. But in the back-channel, you may have a specific api call. </div><div class=""><br class=""></div><div class="">Lot of discussion around how logouts occur and the different nature of related events like account resets, lock-outs, etc. </div><div class=""><br class=""></div><div class="">What are the difference when the session is on a mobile app vs. a web app is revoked? Is it the same or different.</div><div class=""><br class=""></div><div class="">George, when a party receives a notification that a token has been revoked at Facebook, how should it interpret it? Does it matter in every case. I don’t know what you do if SFDC is the IDP which is chained to the enterprise. What happens when a user logs out at a root IDP vs at a chained IDP at SFDC?</div><div class=""><br class=""></div><div class="">George suggested maybe we put together some examples, and share them on the list. </div><div class=""><br class=""></div><div class="">Lots of discussion on whether to send a sub or jti. If all sessions to be revoked would a multi-valued “jti” be sent or would multiple events be sent?</div><div class=""><br class=""></div><div class="">George. If all we are talking about is just logout. If you want to include the concept of a user revoking at token. </div><div class=""><br class=""></div><div class="">John…if the AS doesn’t send an event to the RS, then the RS is forced to poll constantly.</div><div class=""><br class=""></div><div class="">George, does the AS have to track the type of client that is receiving logins and thus the type of notifications it needs? </div><div class=""><br class=""></div><div class="">John: Yes. This would be mostly handled with registration.</div><div class=""><br class=""></div><div class="">George: the issue becomes, for the AS, we have an SP, but its federated with AOL, Ping or whatever. </div><div class=""><br class=""></div><div class="">John: given sufficient generics for subject and scopes we could do the same thing for SAML.</div><div class=""><br class=""></div><div class="">George: There is a model where the SP is relying on the OP to be its issuer. Then yo u have the case where the OP is acting as an AS. Are those cases the same?</div><div class=""><br class=""></div><div class="">What about multiple SPs leveraging a common IDPs. So you still want to do a broadcast to the SPs.</div><div class=""><br class=""></div><div class="">The group discussed that Connect is both authorization (for delegated independent access) and interactive SSO. So the logout may need to differentiate.</div><div class=""><br class=""></div><div class="">If an ID Token is revoked by an originating OP, what should a chaining SP acting as AS do? </div><div class=""><br class=""></div><div class="">George. We should work on a use-case to describe the different classes of logouts and the different intents. Frame what we need to solve or not solve.</div><div class=""><br class=""></div><div class="">Meeting wrapped up due to time.</div><div class=""><br class=""></div><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></div></div></div></body></html>