<div dir="ltr">Thanks Phil and Bhathiya. </div><div class="gmail_extra"><br><div class="gmail_quote">On 19 August 2017 at 21:28, Phil Hunt (IDM) <span dir="ltr"><<a href="mailto:phil.hunt@oracle.com" target="_blank">phil.hunt@oracle.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div>+1.</div><div id="m_9090592392164678770AppleMailSignature"><br></div><div id="m_9090592392164678770AppleMailSignature">The OP (transmitter) only needs to know if the RP is unable to understand or validate the event. It does not need to know the outcome. </div><span class="HOEnZb"><font color="#888888"><div id="m_9090592392164678770AppleMailSignature"><br>Phil</div></font></span><div><div class="h5"><div><br>On Aug 19, 2017, at 12:14 AM, Bhathiya Jayasekara <<a href="mailto:tobhathiyaj@gmail.com" target="_blank">tobhathiyaj@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">Hi Piraveena,<div class="gmail_extra"><br><div class="gmail_quote">On Sat, Aug 19, 2017 at 9:42 AM, Piraveena Paralogarajah <span dir="ltr"><<a href="mailto:piraveena.14@cse.mrt.ac.lk" target="_blank">piraveena.14@cse.mrt.ac.lk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px">Phil,</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Thanks for you response.</div><div style="font-size:12.8px"> </div><div style="font-size:12.8px">But If RP sends HTTP 400 response, then any how OP should handle that. I need that implementation in OP side. Will OP send a logout token again to request the RP? </div></div></blockquote><div><br></div><div>I don't think OP should. As per the spec, RP should send 400 response when **<b>logout token vaidation is failed**</b>. In the 400 response, RP should mention why the validation was failed. However, upon receiving the 400 response, sending the same logout token back to RP will not be of any use as it was a validation failure, which means there was something wrong with the token itself (or a configuration in RP/OP). So I think the only action OP can take here is to notify there was an error with this particular RP (maybe you can log it and proceed with other RPs) and it will require a manual diagnosis to fix the issue if any.</div><div><br></div><div>Since id_token anyway has an expiry time, which means problematic RPs will be logged-out anyway eventually, I don't think this is a major issue. </div><div><br></div><div>Thanks,</div><div>Bhathiya </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Then I will be helpful if you explain how OP will handle this response. </div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">Thanks,</div><div style="font-size:12.8px">Piraveena</div><div><br></div></div><div class="m_9090592392164678770HOEnZb"><div class="m_9090592392164678770h5"><div class="gmail_extra"><br><div class="gmail_quote">On 18 August 2017 at 22:21, Phil Hunt <span dir="ltr"><<a href="mailto:phil.hunt@oracle.com" target="_blank">phil.hunt@oracle.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Piraveena,</div><div><br></div>The log out event (which is based on SET Tokens) is informational. Your question frames the logout as a command rather then an informational event.<div><br></div><div>Some background...</div><div>Normal functionality should be that the RP can only rejects the SET if the SET cannot be validated or parsed (or unauthorized). SETs cannot be processed as commands. Thus the only reason for rejection is to let the issuer know their may be a configuration issue that may impact subsequent SET (ie. logout event) delivery. <div><br></div><div>As to whether the logout is successful or not is for the RP to decide within its own domain. Some Clients may decide they do not care about SSO, some will. This is a contextual decision. This is why SETs in general are framed as FYI type messages rather than commands. IOW a backchannel logout event means “Subject xyz was logged out by the OP”. While we expect down stream RPs to also cancel the users RP session, they are not obligated to do so. Likewise an RP logging a user out does not mean the OP must do the same. This depends on the relationship of the RP to the OP and vice-versa.</div><div><br></div><div>What assurance is there that logout notification worked?</div><div>I do understand that you are looking for an end-to-end confirmation of success. One of my concerns when the Backchannel Logout spec was approved for implementation was that the current draft does not support SET Delivery which provides assured delivery so we can know a potential logout event was received by an RP — giving some assurance that the logout notification was successful.</div><div><br></div><div><div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div><span class="m_9090592392164678770m_1195245678778673614m_-4874800072321710547Apple-style-span" style="border-collapse:separate;line-height:normal;border-spacing:0px"><div style="word-wrap:break-word"><div><div><div>Phil</div><div><br></div><div>Oracle Corporation, Identity Cloud Services Architect & Standards</div><div>@independentid</div><div><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=0lDDt5fABbxtONo4y9OIqWdhbMAh74pLEUGzY5hAXmw&s=SwFPhRZx4Tl5t27ozorxCDAaEmk47T7kOXZD157G4dU&e=" target="_blank">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" target="_blank">phil.hunt@oracle.com</a></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br><div><blockquote type="cite"><div><div class="m_9090592392164678770m_1195245678778673614h5"><div>On Aug 18, 2017, at 5:20 AM, Piraveena Paralogarajah <<a href="mailto:piraveena.14@cse.mrt.ac.lk" target="_blank">piraveena.14@cse.mrt.ac.lk</a>> wrote:</div><br class="m_9090592392164678770m_1195245678778673614m_-4874800072321710547Apple-interchange-newline"></div></div><div><div><div class="m_9090592392164678770m_1195245678778673614h5"><div dir="ltr">Hi all,<div><br></div><div>In Back-channel logout, If the logout is invalid, then RP should respond with HTTP 400 Bad request. Then how P will handle this?</div><div><br></div><div>It will be helpful if someone can explain the workflow.</div><div><br></div><div>Thanks,</div><div>Piraveena<br clear="all"><div><br></div>-- <br><div class="m_9090592392164678770m_1195245678778673614m_-4874800072321710547gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Piraveena Paralogarajah</div><div style="font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Undergraduate,</div><div style="font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Department of Computer Science and Engineering,</div><div style="font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">University of Moratuwa,</div><div style="font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Sri Lanka.</div></div></div></div></div>
</div></div></div></div>
______________________________<wbr>_________________<br>specs mailing list<br><a href="mailto:specs@lists.openid.net" target="_blank">specs@lists.openid.net</a><br><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=sClsY6Tr0v3GB-kLpFWwMO-NEjex-jDO1cqPjxlmWEw&s=hOwq2HHUdE9Z9wRpLT6enJxwjcZVXa9urw32pTZwmeg&e=" target="_blank">https://urldefense.proofpoint.<wbr>com/v2/url?u=http-3A__lists.op<wbr>enid.net_mailman_listinfo_open<wbr>id-2Dspecs&d=DwICAg&c=RoP1YumC<wbr>XCgaWHvlZYR8PQcxBKCX5YTpkKY057<wbr>SbK10&r=JBm5biRrKugCH0FkITSeGJ<wbr>xPEivzjWwlNKe4C_lLIGk&m=sClsY6<wbr>Tr0v3GB-kLpFWwMO-NEjex-jDO1cqP<wbr>jxlmWEw&s=hOwq2HHUdE9Z9wRpLT6e<wbr>nJxwjcZVXa9urw32pTZwmeg&e=</a> <br></div></blockquote></div><br></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="m_9090592392164678770m_1195245678778673614gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Piraveena Paralogarajah</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Undergraduate,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Department of Computer Science and Engineering,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">University of Moratuwa,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Sri Lanka.</div></div></div></div></div>
</div>
</div></div><br>______________________________<wbr>_________________<br>
specs mailing list<br>
<a href="mailto:specs@lists.openid.net" target="_blank">specs@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=0lDDt5fABbxtONo4y9OIqWdhbMAh74pLEUGzY5hAXmw&s=gLiffvJAQLZHc25OyAoZeC6DkRFtFCINZoEY7kLvqu0&e=" rel="noreferrer" target="_blank">http://lists.openid.net/mailma<wbr>n/listinfo/openid-specs</a><br>
<br></blockquote></div><br></div></div>
</div></blockquote></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Piraveena Paralogarajah</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Undergraduate,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Department of Computer Science and Engineering,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">University of Moratuwa,</div><div style="color:rgb(0,0,0);font-family:'Helvetica Neue','Segoe UI',Helvetica,Arial,'Lucida Grande',sans-serif;font-size:13px">Sri Lanka.</div></div></div></div></div>
</div>