Implement Session Management Spec about identityserver3 HOT 10 CLOSED

OIDC board is unsure right now what the right approach is - we will postpone that feature.

from identityserver3.

Is there any update on this? I understand that the spec is still a draft, but I think this is required for functionally implementing the implicit flow in a SPA.

from identityserver3.

We will implement that at some point - but it does not have a high priority.

The spec is actively discussed in the working group right now - expect changes.

from identityserver3.

Interesting, am I correct in understanding that without the check_session_iframe the only way for a session to end, once a user has been authenticated, is for the ID token to expire?

Does this not prevent use of the implicit flow?

from identityserver3.

No - the id token is just the outcome of the authentication process - it is not used to establish a session. The client itself is responsible for creating a session of some sorts.

from identityserver3.

I guess I just mean that without support for the Session Management Spec, specifically check_session_iframe, a RP is left with 2 options:

1. Wait for the ID token to expire
2. Ping the OP for authentication with prompt set to none and interpret an error as the user being logged out

I think the first of which is impractical, but I guess option 2 works.

from identityserver3.

Expect id tokens to be really short lived in practice - we are defaulting to 5 minutes IIRC.

2. is mimicking the session management spec - so yes. That said - we will implement the spec - it is just not done yet.

from identityserver3.

@leastprivilege Now we have the RP initiated logout capability (http://leastprivilege.com/2014/10/14/identityserver-v3-and-post-logout-redirect/) [thank you] that requires the identity token to be maintained by the client in order to pass it back to the OP, are we expecting to have long lived id tokens now, or is 'exp' aspect of validating the token ignored for the logout?

from identityserver3.

Expiration is ignored.

On 14.10.2014, at 21:40, "Ciaran Jessup" <[email protected]mailto:[email protected]> wrote:

Now we have the RP initiated logout capability (http://leastprivilege.com/2014/10/14/identityserver-v3-and-post-logout-redirect/) [thank you] that requires the identity token to be maintained by the client in order to pass it back to the OP, are we expecting to have long lived id tokens now, or is 'exp' aspect of validating the token ignored for the logout?

Reply to this email directly or view it on GitHubhttps://github.com//issues/30#issuecomment-59103815.

from identityserver3.

OK - session ID and check_session_iframe is implemented on dev

from identityserver3.