Business sign-on and provisioning Optional

Listen for security signals from the customer's provider

Receive OpenID Shared Signals events from customers' identity providers, and end sessions when they report a revoked session or a disabled account.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

The OpenID Foundation made the Shared Signals Framework, CAEP and RISC final, each as 1.0, in September 2025. Publish a receiver and set up one stream per organisation, with push delivery as in RFC 8935 or polling as in RFC 8936. Verify each Security Event Token, a signed JWT defined in RFC 8417, as verify every token says. On a CAEP session-revoked or a RISC account-disabled event, run deprovision.

Example

{
  "iss": "https://idp.acme.example",
  "aud": "https://example.com/ssf",
  "iat": 1793606400,
  "jti": "4d3559ec67504aaba65d40b0363faad8",
  "sub_id": { "format": "email", "email": "ana@acme.example" },
  "events": {
    "https://schemas.openid.net/secevent/caep/event-type/session-revoked": { "event_timestamp": 1793606390 }
  }
}

How to check

Send a signed test session-revoked event for a signed-in test user. Their next request answers 401. The same event with a bad signature changes nothing.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/shared-signals.