openid connect - Equivalent of SAML's back-channel Single Log-out in OIDC? -
for openid connect, there equivalent of saml's soap-based single log-out protocol enable identity provider ability terminate remote sessions in rp application? necessary component several security requirements in enterprise environments including not limited to:
- enact limits on number of concurrent sessions terminating previous sessions.
- ability administrators terminate specific sessions or sessions given user.
- ability terminate sessions upon other trigger events, such password change.
that not part of core openid connect specification (http://openid.net/specs/openid-connect-core-1_0.html), nor implementers draft extension session management (http://openid.net/specs/openid-connect-session-1_0.html) btw. include "javascript postmessage based" frontchannel logout.
there work-in-progress on separate logout extension openid connect may standardize backchannel logout, see: http://openid.net/specs/openid-connect-logout-1_0.html, esp. chapter 2 http://openid.net/specs/openid-connect-logout-1_0.html. in draft mode far.
Comments
Post a Comment