Session - 5. Add id_token to the RP initiated logout request

[Nat Sakimura]

Rationale: The draft does not specify any parameters to send to the end_session_endpoint right now. This makes it difficult for the OP to select which session to be logged out when the user has multiple sessions at the OP.

Current:

Sometimes, the RP may want to notify the OP that the user has logged out of the site, and may want to log out of the OP as well. In this case, the RP, after having logged the user out of the RP, sends the user to the OP's logout endpoint URL. This URL is normally obtained via the end_session_endpoint element of the OP's Discovery response, or may be learned via other mechanisms.

Proposal:

Sometimes, the RP may want to notify the OP that the user has logged out of the site, and may want to log out of the OP as well. In this case, the RP, after having logged the user out of the RP, sends the user to the OP's logout endpoint URL with the following parameters:

* id_token  OPTIONAL. The ID Token of the user to be logged out of the OP.

The OP's logout endpoint URL is normally obtained via the end_session_endpoint element of the OP's Discovery response, or may be learned via other mechanisms.

[Michael Jones]

Will do this as discussed on the list, as well as clarifying when the session state "changed" indication might happen, also as discussed on the list.

[Michael Jones]

Fixed in https://bitbucket.org/openid/connect/commits/27c1e229753dd879cbac228732d073028068c4dc