OpenID Connect Back-Channel Logout 1.0

Introduction

This article describes Authlete’s support for the OpenID Connect Back-Channel Logout 1.0 specification.

Specification Overview

The server generates a Logout Token and sends an HTTP POST request containing it to the client’s Back-Channel Logout URI. Upon receiving the Logout Token, the client performs logout processing. A Logout Token is a JWT. The value of its typ header parameter is defined as logout+jwt. Its payload contains either the sub claim, the sid claim, or both, and these claims identify the logout target.

Logout Token API

Authlete provides an API for generating Logout Tokens. The API path is /api/{service-id}/backchannel/logout/token. The request body format is either application/json or application/x-www-form-urlencoded. The request parameters are as follows.

Request Parameter	Necessity	Description
`clientIdentifier`	REQUIRED	The client identifier.
`subject`	OPTIONAL	The subject (identifier) of the end-user. The specified value is used as the value of the `sub` claim in the Logout Token. Either this `subject` parameter or the `sessionId` parameter must be specified.
`sessionId`	OPTIONAL	The session ID. The specified value is used as the value of the `sid` claim in the Logout Token. Either this `sessionId` parameter or the `subject` parameter must be specified.

The response parameters are as follows.

Response Parameter	Description
`logoutToken`	The generated Logout Token.
`backchannelLogoutUri`	The value of the client’s `backchannel_logout_uri` metadata parameter.
`action`	Indicates the next action that the server should take. Possible values are `OK`, `SERVER_ERROR`, and `CALLER_ERROR`. `OK` indicates that the Logout Token was generated successfully.
`resultCode`	A code representing the result of the API call (a parameter included in almost all Authlete API responses).
`resultMessage`	A message describing the result of the API call (a parameter included in almost all Authlete API responses).

The following is an example API call.

curl --oauth2-bearer ${ACCESS_TOKEN} \
  https://${AUTHLETE_SERVER}/api/${SERVICE_ID}/backchannel/logout/token \
  --json '{
  "clientIdentifier": "client001",
  "subject": "user001",
  "sessionId": "sid001"
}'

The following is an example API response.

{
  "action": "OK",
  "logoutToken": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImxvZ291dCtqd3QiLCJraWQiOiIzVFNzM0U4djc3cXhQckhCNUtDendYY3RRajhJY0FBbHRuMThVYWZ1T1RzIn0.eyJpc3MiOiJodHRwczovL3RyaWFsLmF1dGhsZXRlLm5ldCIsInN1YiI6InVzZXIwMDEiLCJhdWQiOiJjbGllbnQwMDEiLCJpYXQiOjE3Nzg0NjE1NjIsImV4cCI6MTc3ODQ2MTY4MiwianRpIjoiMzBhNjljZTctMTQ0YS00MTc5LWIzOGItMTMyNDc1ZDk3Y2E4Iiwic2lkIjoic2lkMDAxIiwiZXZlbnRzIjp7Imh0dHA6Ly9zY2hlbWFzLm9wZW5pZC5uZXQvZXZlbnQvYmFja2NoYW5uZWwtbG9nb3V0Ijp7fX19.rmckdJrYEZg5i085KFMXLpHkPLHe63sjk8Qr9UwRJKBEAIueJomJ0DdzbOybm4475_DtP8wxkhAG0hE_YZgYyQ",
  "backchannelLogoutUri": "https://client.example.com/logout",
  "resultCode": "A518001",
  "resultMessage": "[A518001] A Logout Token for the client 'client001' was issued successfully."
}

Decoding the header and payload of the Logout Token included in this example yields the following.

{
  "alg": "ES256",
  "typ": "logout+jwt",
  "kid": "3TSs3E8v77qxPrHB5KCzwXctQj8IcAAltn18UafuOTs"
}

{
  "iss": "https://trial.authlete.net",
  "sub": "user001",
  "aud": "client001",
  "iat": 1778461562,
  "exp": 1778461682,
  "jti": "30a69ce7-144a-4179-b38b-132475d97ca8",
  "sid": "sid001",
  "events": {
    "http://schemas.openid.net/event/backchannel-logout": {}
  }
}

Note that the current implementation of the /api/{service-id}/backchannel/logout/token API does not automatically revoke tokens. If token revocation is necessary, trigger it explicitly, for example by calling the revocation endpoint.

Metadata

The OpenID Connect Back-Channel Logout 1.0 specification defines two server metadata parameters and two client metadata parameters. Corresponding properties have been added to Authlete’s Service and Client models as well.

Service Property	Description
`backchannelLogoutSupported`	This property indicates whether this service supports the OpenID Connect Back-Channel Logout 1.0 specification. This property corresponds to the `backchannel_logout_supported` server metadata parameter defined in the specification.
`backchannelLogoutSessionSupported`	This boolean property indicates whether this service supports the `sid` claim in Logout Tokens. This property corresponds to the `backchannel_logout_session_supported` server metadata parameter defined in the OpenID Connect Back-Channel Logout 1.0 specification. If this property is set to `true`, API calls to the `/api/{service-id}/backchannel/logout/token` API should include the `sessionId` request parameter, whose value is embedded in the Logout Token as the value of the `sid` claim. Likewise, API calls to the `/api/{service-id}/auth/authorization/issue` API should include the `sessionId` request parameter, whose value is embedded in ID Tokens as the value of the `sid` claim.

Client Property	Description
`backchannelLogoutUri`	The Back-Channel Logout URI defined in the OpenID Connect Back-Channel Logout 1.0 specification. It must be an HTTP-accessible URL because HTTP POST requests containing a Logout Token are sent to the endpoint. This property corresponds to the `backchannel_logout_uri` client metadata parameter defined in the specification. The URL must consist only of ASCII characters and must not exceed 200 characters in length. The scheme must be either `https` or `http`, and the URL must not contain a fragment component. The configured value will be included in the response from the `/api/{service-id}/backchannel/logout/token` API as the value of the `backchannelLogoutUri` parameter.
`backchannelLogoutSessionRequired`	This boolean property indicates whether this client requires Logout Tokens to include the `sid` claim. This property corresponds to the `backchannel_logout_session_required` client metadata parameter defined in the OpenID Connect Back-Channel Logout 1.0 specification.

Conclusion

Support for the OpenID Connect Back-Channel Logout 1.0 specification is available starting with Authlete version 3.0.32. For more information, please contact us via the contact form.

Basic OAuth/OIDC Flows

Advanced Flows

Protocol Extensions

Compliance Profiles

Verifiable Credentials

OpenID Connect Back-Channel Logout 1.0

Introduction

Specification Overview

Logout Token API

Metadata

Conclusion

​Introduction

​Specification Overview

​Logout Token API

​Metadata

​Conclusion

Introduction

Specification Overview

Logout Token API

Metadata

Conclusion