OP RP-Initiated Logout and user's presence

Originally submitted by Andrii Deinega (Andrii Deinega) on 2024-06-05

https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout states clearly that

An RP requests that the OP log out the End-User by redirecting the End-User's User Agent to the OP's Logout Endpoint

it would be a significant improvement from a security perspective if this spec, or a new specification (extension), allowed an RP to request the OP to log out a user without his presence (when it’s permitted by the OP polices). There are lots of cases where it’s impossible to redirect a user say when the user closes his laptop and goes home. For this sort of cases, it’s highly desirable to clearly communicate via a reliable backchannel to the OP: “hi, you know, I’ve logged this user off so that a new auth request from him needs to be authenticated, and also please, invalidate his access token issued before to me“.

There are ways to handle this now:

1. use the token revocation endpoint (so an RP can invalidate an AT)
2. force a user to be authenticated for all authentication requests from an RP (with the help of the prompt parameter set to login)
3. rely on Shared Signals and Events Framework (SSE) & CAEP events

However, these methods have their downsides and don’t provide a simple, comprehensive solution.

Lastly, I discussed this use case a bit with Mike Jones at a recent IIW, and he suggested at least to fill an issue for tracking purposes.

Bitbucket status: open

Bitbucket origin: issue 2157

Start by reading the RP-Initiated Logout specification section linked in the issue, then compare the token revocation endpoint, prompt=login, and SSE/CAEP alternatives. No repository file or test is identified; done would be a settled specification or extension proposal for reliable logout without the user's presence, including the stated authentication and token-invalidation behavior.