Re: [OAUTH-WG] What Does Logout Mean?
"Richard Backman, Annabelle" <richanna@amazon.com> Fri, 30 March 2018 18:48 UTC
Return-Path: <prvs=620b79a89=richanna@amazon.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 534EF1273B1 for <oauth@ietfa.amsl.com>; Fri, 30 Mar 2018 11:48:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Level:
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=amazon.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xkHBg7uWA0mp for <oauth@ietfa.amsl.com>; Fri, 30 Mar 2018 11:48:07 -0700 (PDT)
Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B241A12711E for <oauth@ietf.org>; Fri, 30 Mar 2018 11:48:04 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1522435684; x=1553971684; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=N5vEIV5zY5haEUjhanWQXkAL2jBEBvTXrIznSrhopKo=; b=Un1ZBuH063+H7HyTRGhF5mciHYYmGik9ziTBcZ1P7Es74f+XHP6NdzBk Ur0d39xh/F5iEKCSqdn227mrwKts67sPJGVEkpzKYcjQMtIudspH6khQ5 gki9Zt9RHs6WhjWDddPVMQGh2Jrr7vHRK6ZrFIFuuCURJuqvUHhgKimau k=;
X-IronPort-AV: E=Sophos;i="5.48,382,1517875200"; d="scan'208";a="603968690"
Received: from sea3-co-svc-lb6-vlan3.sea.amazon.com (HELO email-inbound-relay-1d-38ae4ad2.us-east-1.amazon.com) ([10.47.22.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP/TLS/DHE-RSA-AES256-SHA; 30 Mar 2018 18:48:02 +0000
Received: from EX13MTAUWC001.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1d-38ae4ad2.us-east-1.amazon.com (8.14.7/8.14.7) with ESMTP id w2UIluIb049477 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 30 Mar 2018 18:48:00 GMT
Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13MTAUWC001.ant.amazon.com (10.43.162.135) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 30 Mar 2018 18:47:59 +0000
Received: from EX13D11UWC004.ant.amazon.com (10.43.162.101) by EX13D11UWC004.ant.amazon.com (10.43.162.101) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 30 Mar 2018 18:47:59 +0000
Received: from EX13D11UWC004.ant.amazon.com ([10.43.162.101]) by EX13D11UWC004.ant.amazon.com ([10.43.162.101]) with mapi id 15.00.1236.000; Fri, 30 Mar 2018 18:47:59 +0000
From: "Richard Backman, Annabelle" <richanna@amazon.com>
To: Bill Burke <bburke@redhat.com>
CC: Mike Jones <Michael.Jones@microsoft.com>, Roberto Carbone <carbone@fbk.eu>, "oauth@ietf.org" <oauth@ietf.org>, Nat Sakimura <nat@sakimura.org>
Thread-Topic: [OAUTH-WG] What Does Logout Mean?
Thread-Index: AdPFuZ82AUZiFFvRRIWVC98G86INvgA7mmyA//+yZICAAI4MgP//m6SAgACNGQCAAmHFgIAAgaKA//+dPwA=
Date: Fri, 30 Mar 2018 18:47:59 +0000
Message-ID: <2D841B39-7A79-42C0-AB3C-E6C473CC6977@amazon.com>
References: <DM5PR00MB02932B889807DF883C006512F5A30@DM5PR00MB0293.namprd00.prod.outlook.com> <CABRXCmykJMcy-PdapRURd7YuZxfMbD9dHkf89AKxObM_2bAqKQ@mail.gmail.com> <9A072F0C-96A0-4F5C-8FD0-76110AA2FA3E@amazon.com> <CABRXCmy6aUO_1=Sp08U=B2mV22oP96-R9t16sDsZbo0vDX6fnQ@mail.gmail.com> <BA42F798-A4E6-43D9-9A93-D85C6C5AF4AA@amazon.com> <CABRXCmxWaU8741R8ux2JAo+LmaLsr+Rh=XADLeyV=7cCjqsokQ@mail.gmail.com> <7B1638A7-ADAD-4AE1-8AF8-6E26853D32C7@amazon.com> <CABRXCmzPn5Cb-y-em6Lf0yqUf=bYy1iev84V07_URWE-PM=WCg@mail.gmail.com>
In-Reply-To: <CABRXCmzPn5Cb-y-em6Lf0yqUf=bYy1iev84V07_URWE-PM=WCg@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.b.0.180311
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.43.160.20]
Content-Type: text/plain; charset="utf-8"
Content-ID: <1B92B40F6621D94EB9A14AEBC9F8C71F@amazon.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Precedence: Bulk
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/UskCHyToABAYnjPUR50AmqeyZfw>
Subject: Re: [OAUTH-WG] What Does Logout Mean?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Mar 2018 18:48:09 -0000
It sounds like you're asking the OP to provide client-side session management as a service. There may be value in standardizing that, but I think it goes beyond what Backchannel Logout is intended to do. -- Annabelle Richard Backman Amazon – Identity Services On 3/30/18, 10:42 AM, "Bill Burke" <bburke@redhat.com> wrote: On Fri, Mar 30, 2018 at 12:57 PM, Richard Backman, Annabelle <richanna@amazon.com> wrote: > > FWIW, our OP implementation allows RPs to register their node specific > logout endpoints at boot. This request is authenticated via client > authentication. We also extended code to token request to transmit the > local session id. The OP stores this information. Backchannel logout POSTS > to each and every registered node and transmits a JWS signed by the OP > containing the local session ids to invalidate. That's been enough to cover > all the weirdness out there so far. > > [richanna] > > What does “at boot” mean in the context of OpenID Connect? Do you mean that > for every logout, the OP makes a Backchannel Logout request to each of the > client’s node-specific logout endpoints? Just in case....This is all for backchannel logouts which are out of band from the browser. Node boots up and registers with the Auth Server its logout endpoint. POST /authserver/node_registration client_id=myclient& client_secret=geheim& node=https://node.internal:8443/app/oidc/_logout As I mentioned earlier, the node doing code to token request will also pass its local session id so it can be associated with the Auth server's SID. When an admin initiates a forced logout, a backchannel logout request is sent to each client's logout endpoint. If the client has nodes that have registered, this request is duplicated to each node. > If that’s the case, why can’t the > client make those calls themselves, from whichever host happens to receive > the Backchannel Logout request? > Your assuming that each node has knowledge of cluster topology which isn't neccesarily true. Each additional proprietary extension we've made is optional. Nodes can optionally register themselves. Nodes can optionally send local session ids with the code to token request. > > > Since the client only cares about node-local state, they should be able to > maintain the mapping between OP session IDs and local session IDs on their > side. > Considering a cluster of load balanced web applications that dont' have session replication and don't have knowledge of cluster topology. The only way for the Auth Server to perform backchannel logout is to send the same backchannel logout to each and every node. There's also the case where the nodes do support session replication, but don't have a way to get at topology or a way to store the association between the SID and application session id. In this case you don't need node registration, but you do need a way to associate the SID with the local session id. As a IDP vendor, you have to support all these types of clients. Telling developers that they are just going to have to manage this themselves is not really an option if you want adoption. Bill
- [OAUTH-WG] What Does Logout Mean? Mike Jones
- Re: [OAUTH-WG] What Does Logout Mean? Bill Burke
- Re: [OAUTH-WG] What Does Logout Mean? Richard Backman, Annabelle
- Re: [OAUTH-WG] What Does Logout Mean? David Waite
- Re: [OAUTH-WG] What Does Logout Mean? Bill Burke
- Re: [OAUTH-WG] What Does Logout Mean? Richard Backman, Annabelle
- Re: [OAUTH-WG] What Does Logout Mean? Bill Burke
- Re: [OAUTH-WG] What Does Logout Mean? Richard Backman, Annabelle
- Re: [OAUTH-WG] What Does Logout Mean? Bill Burke
- Re: [OAUTH-WG] What Does Logout Mean? Richard Backman, Annabelle
- Re: [OAUTH-WG] What Does Logout Mean? Bill Burke
- Re: [OAUTH-WG] What Does Logout Mean? Phil Hunt