Session management: RP-init logout: Proposal for optional ui_locales parameter

[Vladimir Dzhuvinov]

At the end-session endpoint the end-user typically needs be presented with a confirmation dialog. For that reason I would like to propose a new optional parameter for the RP-initiated logout request -- "ui_locales", identical to the one already available for OpenID authentication requests.

We can reuse the description in Core for that:

ui_locales OPTIONAL. End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider.

[Nat Sakimura]

Include it in the next rev.

[Michael Jones]

There was agreement on the June 13th call to add this to the next revision.

[damienbod damienbod]

Should this not already be defined as it is part of the Core specification. So all providers should support this anyway.

http://openid.net/specs/openid-connect-core-1_0.html#ServerMTI

[Michael Jones]

We discussed this on the 30-Jul-20 working group call. This seems innocuous but we wondered if it’s necessary. In particular, does the OP already have a way to know the right locale information because the RP already provided it in the authentication request?

In theory, the id_token_hint ID Token should let the OP know what session this is about. But it may be simpler just to add this parameter, as requested. Comments?

[Vladimir Dzhuvinov]

Getting the UI locale from the session at the OP will indeed work.

I see one issue with this method - when the OP session has expired. In that case the RP can help the OP, as it still has a session for the user, if the RP has a chance to pass the ui_locales with the logout request.

IMO we should aim to provide implementers (those who want to get i18n right) with a protocol which has no potential gaps / undefined places in terms of UI locale.

[Michael Jones]

Fixed #1017 - Added 'ui_locales' parameter at Logout Endpoint

→ <<cset 44739cf65fe4>>