Support distributed sign-out

[Tratcher]

When another site triggers a sign-out at the IDP, the client may be redirected to us with a sign-out message. We need to detect sign-out messages and allow the application to take meaningful action. The default could be just calling signout with the SignInScheme, but you also need to allow for the case where Identity has issued their own cookie.

[kevinchalet]

Definitely a must-have 👍

[Tratcher]

Design:

• The browser sends a GET to an address pre-configured in the IDP.
• The middleware listens for GETs on this exact path. There is no default value, so if it's not set then the feature is disabled.
• The AAD implementation does not currently include any validation parameters, but there will eventually be some validation required on the request. @blowdart, is this going to be a problem?
• Fire a new SignOutReceived event. There can be a default implementation that calls SignOut(options.SignInScheme), but this will only work in single-cookie configurations. If the app is configured with a separate application cookie (like in the templates) it will need to hook this notification, verify the user is even signed-in with OIDC, and perform any sign-out actions.
• What should the response look like? an empty 200?

[kevinchalet]

Heh, no.

There are official drafts for this feature, don't try to reinvent the wheel:

• http://openid.net/specs/openid-connect-backchannel-1_0.html
• http://openid.net/specs/openid-connect-logout-1_0.html

Of course these are drafts, but it's probably better than trying to follow the AAD-specific implementation.

The browser sends a GET to an address pre-configured in the IDP.
The middleware listens for GETs on this exact path. There is no default value, so if it's not set then the feature is disabled.

In the first draft, only POST is allowed (with application/x-www-form-urlencoded): http://openid.net/specs/openid-connect-backchannel-1_0.html#BCRequest. Only the the other one supports GET.

The AAD implementation does not currently include any validation parameters, but there will eventually be some validation required on the request. @blowdart, is this going to be a problem?

Unless you want to expose all the ASP.NET 5 apps to the superlogout.com syndrome... yeah 😄
The first draft adds a new (mandatory) "logout token" and the other one an optional "sid" to mitigate this risk. IMHO, it shouldn't be optional and should be enforced to prevent unsolicited logouts.

• http://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken
• http://openid.net/specs/openid-connect-logout-1_0.html#OPLogout

[kevinchalet]

I updated my post to include the older logout draft, which is probably the draft implemented by the AAD team: http://openid.net/specs/openid-connect-logout-1_0.html#RPLogout.

That said, this draft offers a less flexible approach than the one described in the newer backchannel draft as it requires the participation of the user, since the logout request is necessarily flowed by the user agent itself in this case. Implementing the other would be much appropriate for a web-server app.

[Eilon]

We were indeed worried about griefing users by logging them out of other sites. Having a token would be great.

[leastprivilege]

Definitely agree not to implement anything AAD specific.

The back-channel spec is pretty new (1-2 weeks old) and will change for sure.
The front-channel one is more mature and generally more applicable since it does not require book keeping on the authentication session and no direct connection between IdP and RP. And it is also closest to what people have been doing with WS-Fed.

That said - none of them are perfect and ideally we'd need both - but I would start with the front channel one.

[leastprivilege]

For completeness - there is actually a third spec (the original one):

http://openid.net/specs/openid-connect-session-1_0.html

This is generally considered to be the "best" (technically speaking) - but harder to implement (especially in existing applications).

Here's a "middleware-ish" approach to it that does not require explicit coding (Apache module)
https://github.com/pingidentity/mod_auth_openidc/wiki/Session-Management

fyi.

[kevinchalet]

This is generally considered to be the "best" (technically speaking) - but harder to implement (especially in existing applications).

Yeah 👍
I didn't mention this one because it feels - IMHO - really tricky to implement in a generic ASP.NET 5 middleware (you'd have to "automatigically" inject an iframe in the HTML pages or ask the user to add it himself).