<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">A diffrent signing key won’t help unless the issuer is different. <div class=""><br class=""></div><div class="">It is a double edged thing you want the issuer to be the same to know the logout source is the same as the login, however you don’t want the issuer to be the same to prevent the token from being mistaken as a id_token for login.</div><div class=""><br class=""></div><div class="">Logically it would be better to have a different logout audience for the client and change that.</div><div class=""><br class=""></div><div class="">One option would be to use the URI that the client publishes for its backchannel endpoint as the audience rather then the client ID.</div><div class=""><br class=""></div><div class="">I think William made a proposal along those lines.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Mar 16, 2017, at 11:16 AM, Justin Richer <<a href="mailto:jricher@MIT.EDU" class="">jricher@MIT.EDU</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">+1<br class=""></p><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><div class="moz-cite-prefix" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);">On 3/16/2017 7:58 AM, Axel Nennker via Openid-specs-ab wrote:<br class=""></div><blockquote cite="mid:ef69fa0ceaef4d39895037004578347f@HE101654.emea1.cds.t-internal.com" type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Hi,<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Nonce in the logout JWT is prohibited<span class="Apple-converted-space"> </span></span>to make a Logout Token syntactically invalid compared to an id_token.<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Wouldn’t it be more secure to use another signing key than the id_token signing key?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Prohibiting nonce is a hack.<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Kind regards<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Axel<span style="font-size: 12pt;" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">The following Claim MUST NOT be used within the Logout Token:<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">nonce<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 72pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">PROHIBITED. A<span class="Apple-converted-space"> </span></span><span style="font-size: 10pt;" class="">nonce</span><span style="font-size: 12pt;" class=""><span class="Apple-converted-space"> </span>Claim MUST NOT be present. Its use is prohibited to make a Logout Token syntactically invalid if used in a forged Authentication Response in place of an ID Token.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">Logout Tokens MAY contain other Claims. Any Claims used that are not understood MUST be ignored.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">A Logout Token MUST be signed and MAY also be encrypted. The same keys are used to sign and encrypt Logout Tokens as are used for ID Tokens. NOTE: The Logout Token is compatible with<span class="Apple-converted-space"> </span><a moz-do-not-send="true" href="http://openid.net/specs/openid-connect-backchannel-1_0.html#I-D.ietf-secevent-token" style="color: purple; text-decoration: underline;" class="">Security Event Token (SET)</a><span class="Apple-converted-space"> </span>[I‑D.ietf‑secevent‑token] draft -00.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class="">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;" class=""><span class="Apple-converted-space"> </span>Nennker, Axel<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, March 16, 2017 12:49 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Mike Jones (<a class="moz-txt-link-abbreviated" href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline;">Michael.Jones@microsoft.com</a>); John Bradley (<a class="moz-txt-link-abbreviated" href="mailto:ve7jtb@ve7jtb.com" style="color: purple; text-decoration: underline;">ve7jtb@ve7jtb.com</a>)<br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">openid-specs-ab@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>backchannel logout: events<o:p class=""></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi,<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Regarding<span class="Apple-converted-space"> </span><a class="moz-txt-link-freetext" href="https://openid.net/specs/openid-connect-backchannel-1_0.html" style="color: purple; text-decoration: underline;">https://openid.net/specs/openid-connect-backchannel-1_0.html</a><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I am wondering what the reason behind events is:<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">events<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt 36pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt;" class="">REQUIRED. Claim whose value is a JSON object containing the member name<span class="Apple-converted-space"> </span></span><span style="font-size: 10pt;" class=""><a class="moz-txt-link-freetext" href="http://schemas.openid.net/event/backchannel-logout" style="color: purple; text-decoration: underline;">http://schemas.openid.net/event/backchannel-logout</a></span><span style="font-size: 12pt;" class="">. This declares that the JWT is a Logout Token. The corresponding member value MUST be a JSON object and SHOULD be the empty JSON object<span class="Apple-converted-space"> </span></span><span style="font-size: 10pt; font-family: 'Courier New';" class="">{}</span><span style="font-size: 12pt;" class="">.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The reason, I think, to have “events” is to make the logout JWT compatible to SET:<span class="Apple-converted-space"> </span><a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/draft-ietf-secevent-token-01" style="color: purple; text-decoration: underline;">https://tools.ietf.org/html/draft-ietf-secevent-token-01</a><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">But SET states: “Security Events are not commands issued between parties”<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">While openid-connect-backchannel-1_0.html JWT is a command.<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">If we want SET compatibility wouldn’t it make more sense to have a SET compatible response to the logout command?<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Why is SET compatibility important? Is it important enough to justify this really strange type specifier?<o:p class=""></o:p></div><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">"events": {<o:p class=""></o:p></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""> <a class="moz-txt-link-rfc2396E" href="http://schemas.openid.net/event/backchannel-logout" style="color: purple; text-decoration: underline;">"http://schemas.openid.net/event/backchannel-logout"</a>: {}<o:p class=""></o:p></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""> }<o:p class=""></o:p></pre><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Kind regards<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Axel<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(153, 153, 153);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(153, 153, 153);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(153, 153, 153);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(153, 153, 153);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><span lang="DE" style="font-size: 8pt; font-family: Arial, sans-serif; text-transform: uppercase;" class="">DEUTSCHE TELEKOM AG<o:p class=""></o:p></span></b></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" style="font-size: 8pt; font-family: Arial, sans-serif;" class="">T-Labs (Research & Innovation)<br class="">Dipl.-Inform. Axel Nennker<br class="">Winterfeldtstr. 21, 10781 Berlin<br class=""></span><span lang="FR" style="font-size: 8pt; font-family: Arial, sans-serif;" class="">+491702275312 (Mobile)<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="FR" style="font-size: 8pt; font-family: Arial, sans-serif;" class="">E-Mail:<span class="Apple-converted-space"> </span><a class="moz-txt-link-abbreviated" href="mailto:axel.nennker@telekom.de" style="color: purple; text-decoration: underline;">axel.nennker@telekom.de</a></span><span lang="DE" class=""><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span lang="DE" class=""><o:p class=""> </o:p></span></div></div><br class=""><fieldset class="mimeAttachmentHeader"></fieldset><br class=""><pre wrap="" style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre></blockquote><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><br class="Apple-interchange-newline"></div></blockquote></div><br class=""></div></body></html>