Logout

[Johnny Bufu]

On 6-Apr-07, at 12:13 PM, Praveen Alavilli wrote:
> well with OpenID atleast, I think we can easily design a logout
> extension, where an RP can register it's logout handler with OP during
> login flow (checkid_immediate/checkid_setup) and the OP could call  
> each
> of the RP's logout handlers (in the browser) that are registered with
> the current session when a user logs out from the OP.

Interesting - what you're describing above looks a lot like the  
update_url feature in AX. Which makes me think that this could  
actually work with what we have today, if we defined a "openid-logout- 
notification" attribute, and the RPs registered for updates when its  
value changes.

> Ofcourse this also requires a new logout mode supported by OP,  
> which an RP can call when a
> user wants to logout from the RP itself. The OP then can provide  
> options
> to the user whether to sign out from one RP or from all.
>
> Any reason why something like this was not incorporated into the  
> specs yet ?

Not sure where this feature would be placed best.


Johnny