Discuss/Define: Notifications

[jischr]

topics to cover:

• Receive Notifications of Revoked Tokens
  • be notified when tokens have been revoked
• Receive Notifications of Invalidated Sessions
  • be notified when sessions have been invalidated

[dhs-BI]

At first glance, I didn't understand why you didn't include #25 in this list, now I see you've separated the items.

Is there a reason these are defined as "notifications" and #25 is defined as "signals?"

[jischr]

@dhs-BI i just broke down based on the sections in https://github.com/openid/ipsie/blob/main/ipsie-v1-draft.md#receive-notifications-of-invalidated-sessions

i was curious too if there was a difference semantically or functionally between "notifications" and "signals"

[aaronpk]

I think those two are meant to be the same. The point of both "be notified when sessions have been invalidated" and "receive real-time signals about changes in account posture or integrity" is that the sender says "this happened", with no expectation of the behavior of the recipient. This is mean to be in contrast to something like backchannel logout which is a "command" that has a clear expectation of what the recipient should do.

[dhs-BI]

Thanks @aaronpk and @jischr. Let's discuss on the call today with the intent of merging these into a single set of items.

[timcappalli]

2025-01-07 call: notifications tend to be user centric. Group leaning towards "signals" (#25).

[aaronpk]

I moved these two over to #25.