<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#002060">Frankly, I would expect that a Back-Channel Logout implementation built using these libraries would use the JWT support directly and then process the “events” claim with its “http://schemas.openid.net/event/backchannel-logout”
element directly in the implementation, just as they would be directly processing the “sid” claim. There would be no SET layer – rather, simply a direct implementation of the Logout Token as a JWT with a particular set of claims. If I were writing the code,
that’s certainly how I’d do it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The working group could decide whether to also commission the implementation of logout functionality after these libraries are contributed, but it’s not reasonable to make that functionality a requirement at
this stage, especially given that the logout specs are not final specifications yet. (There are also no certification tests for the logout functionality yet – something on the certification roadmap, but not yet done.) Rather, I think we should applaud Google
for sponsoring work on three high-quality libraries, getting them certified, and contributing them to the OpenID Connect working group.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060">The other thing the working group could also consider in the future is whether to commission the creation of additional libraries – such as .NET, Ruby, and PHP libraries. But not having those shouldn’t stand
in the way of accepting the ones that are available, once they’re done.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#002060"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net>
<b>On Behalf Of </b>Phil Hunt via Openid-specs-ab<br>
<b>Sent:</b> Friday, June 1, 2018 5:54 PM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-ab] Contributing RP libraries to the Connect WG<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would like to see this planned for inclusion of SET and the backchannel logout and RISC drafts. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">It would seem wasteful to have two libraries that are 98% the same given SETs dependence on JWT. <o:p></o:p></p>
<div id="AppleMailSignature">
<p class="MsoNormal">Phil<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On May 31, 2018, at 12:26 PM, Mike Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">As many of you know, Google has commissioned the creation of high-quality JWT/OpenID Connect RP libraries in Python, Java, and JavaScript. Just as the AppAuth libraries were previously contributed to the OpenID Connect working group, Google
would like to contribute these to the working group when they are ready. The Python library has already achieved certification and is ready.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">As board secretary, I’ve been working with them on some of the logistics of this. The proposed GitHub project names are:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/openid/JWTConnect-Python">https://github.com/openid/JWTConnect-Python</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/openid/JWTConnect-Java">https://github.com/openid/JWTConnect-Java</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/openid/JWTConnect-JS">https://github.com/openid/JWTConnect-JS</a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">These are intentionally somewhat parallel to these existing project names:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openid_AppAuth-2DAndroid&d=DwMFAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=ragdJZ2jRiCe84eWbQm5c3Vbm8OFoSghHAthfm3CUfY&s=TeB8LG6u-PBR9WQoi-i-BEuzBR6Gxov0UWs_4XdWQxs&e=">https://github.com/openid/AppAuth-Android</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://github.com/openid/AppAuth-iOS">https://github.com/openid/AppAuth-iOS</a><o:p></o:p></p>
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openid_AppAuth-2DJS&d=DwMFAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=ragdJZ2jRiCe84eWbQm5c3Vbm8OFoSghHAthfm3CUfY&s=WIhbzPsIFUPK65Pq-ILPPUWDkO-Yphp_hT-FC7ILnXU&e=">https://github.com/openid/AppAuth-JS</a><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Core maintainers/committers/reviewers would be identified for each library at the time of its contribution. Roland Hedberg would be in this set for the Python library.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">This note is to inform the working group of this possibility and to solicit feedback from the working group, since these would become a project of the working group.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> --- Mike<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</blockquote>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=ragdJZ2jRiCe84eWbQm5c3Vbm8OFoSghHAthfm3CUfY&s=ujsXzBY9gF7kssRSyT-hp2y3nGOEVoIBmHmhj0xRYVU&e=">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=ragdJZ2jRiCe84eWbQm5c3Vbm8OFoSghHAthfm3CUfY&s=ujsXzBY9gF7kssRSyT-hp2y3nGOEVoIBmHmhj0xRYVU&e=</a><o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
</body>
</html>