[oauth-ext-review] [IANA #1240049] FW: Request to register OAuth Parameter for OpenID Connect Logout Specifications

[Sabrina Tanamal via RT <[e-mail]>]

Hi Mike, 

This update is complete: 

https://www.iana.org/assignments/oauth-parameters

Best regards, 

Sabrina Tanamal
Lead IANA Services Specialist

On Thu Sep 22 17:44:48 2022, [e-mail] wrote:
> Dear IANA,
> 
> Can you please update the existing registration for the
> "session_state" parameter at https://www.iana.org/assignments/oauth-
> parameters/oauth-parameters.xhtml#parameters to use this reference and
> this link to the reference?
> 
> OpenID Connect Session Management 1.0, Section 2
> https://openid.net/specs/openid-connect-session-
> 1_0.html#CreatingUpdatingSessions
> 
> Thank you,
> -- Mike
> 
> From: Hannes Tschofenig <[e-mail]>
> Sent: Monday, September 19, 2022 9:09 AM
> To: Mike Jones <[e-mail]>
> Cc: [e-mail]
> Subject: RE: Request to register OAuth Parameter for OpenID Connect
> Logout Specifications
> 
> Thanks for the background, Mike.
> 
> I approve the addition of the session_state parameter to the OAuth
> Parameters registry.
> 
> Ciao
> Hannes
> 
> From: Mike Jones
> <[e-mail]<mailto:[e-mail]>>
> Sent: Monday, September 19, 2022 5:38 PM
> To: Hannes Tschofenig
> <[e-mail]<mailto:[e-mail]>>
> Cc: [e-mail]<mailto:[e-mail]>
> Subject: RE: Request to register OAuth Parameter for OpenID Connect
> Logout Specifications
> 
> The confusion is caused by OpenID Connect using the terms
> Authentication Request and Authentication Response instead of the
> OAuth terms Authorization Request and Authorization Response.  The
> connect Authentication messages are extensions to the OAuth
> Authorization messages.  For the OAuth registrations, the OAuth terms
> are used.
> 
> Hopefully that clears things up.
> 
> -- Mike
> 
> From: Hannes Tschofenig
> <[e-mail]<mailto:[e-mail]>>
> Sent: Monday, September 19, 2022 4:17 AM
> To: Mike Jones
> <[e-mail]<mailto:[e-mail]>>
> Cc: [e-mail]<mailto:[e-mail]>
> Subject: RE: Request to register OAuth Parameter for OpenID Connect
> Logout Specifications
> 
> Hi Mike,
> 
> A few questions: Here is the section that defines the session_state
> parameter:
> 
> "
> 2.  Creating and Updating Sessions
> 
> In OpenID Connect, the session at the RP typically starts when the RP
> validates the End-User's ID Token. Refer to the OpenID Connect Core
> 1.0 [OpenID.Core]<https://openid.net/specs/openid-connect-session-
> 1_0.html#OpenID.Core> specification to find out how to obtain an ID
> Token and validate it. When the OP supports session management, it
> MUST also return the Session State as an additional session_state
> parameter in the Authentication Response and SHOULD also return the
> Session State as an additional session_state parameter in the
> Authentication Error Response. The OpenID Connect Authentication
> Response is specified in Section 3.1.2.5 of OpenID Connect Core 1.0.
> The OpenID Connect Authentication Error Response is specified in
> Section 3.1.2.6 of OpenID Connect Core 1.0.
> 
> This parameter is:
> session_state
> Session State. JSON [RFC7159]<https://openid.net/specs/openid-connect-
> session-1_0.html#RFC7159> string that represents the End-User's login
> state at the OP. It MUST NOT contain the space (" ") character. This
> value is opaque to the RP. This is REQUIRED if session management is
> supported.
> 
> The Session State value is initially calculated on the server. The
> same Session State value is also recalculated by the OP iframe in the
> User Agent. The generation of suitable Session State values is
> specified in Section 3.2<https://openid.net/specs/openid-connect-
> session-1_0.html#OPiframe>, and is based on a salted cryptographic
> hash of Client ID, origin URL, and OP User Agent state. For the origin
> URL, the server can use the origin URL of the Authentication Response,
> following the algorithm specified in Section 4 of RFC
> 6454<https://openid.net/specs/openid-connect-session-1_0.html#RFC6454>
> [RFC6454].
> "
> 
> This text says that the session_state parameter is used in the
> Authentication Response and in the Authentication Error Response. The
> registration, however, is for the authorization response, and access
> token response messages. So, there seems to be some inconsistency.
> 
> Ciao
> Hannes
> 
> 
> From: Mike Jones
> <[e-mail]<mailto:[e-mail]>>
> Sent: Tuesday, September 13, 2022 11:03 PM
> To: Hannes Tschofenig
> <[e-mail]<mailto:[e-mail]>>
> Cc: [e-mail]<mailto:[e-mail]>
> Subject: Request to register OAuth Parameter for OpenID Connect Logout
> Specifications
> 
> Dear Designated Expert (Hannes),
> 
> Can you please approve the following OAuth Parameter registration from
> this specification?
> 
> *   https://openid.net/specs/openid-connect-session-
> 1_0.html#ParametersContents "session_state"
> 
> Thanks,
> -- Mike
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.