Forcing a claims refresh from STS to RP

Question

We have implemented a custom STS solution (there are sensible reasons in this, and I don't want to make this the point of the question). In this STS, the user can update his/her profile data (first name, last name, email, etc.) and by doing that, that same user obviously updates their own claims.

However, I am still trying to figure out how to notify RPs that there was a change in the claims for one particular user. I have checked other threads on SO regarding RP claims invalidation, and it seems that most answers relate or point to http://garrettvlieger.com/blog/2010/03/refreshing-claims-in-a-wif-claims-aware-application/.

However: this link is (1) old and (2) assumes the RP is doing the update, which in my case, it isn't.

So: how does one go about pinging each RP to update its claims? Is there a built-in mechanism, or do I have to roll my own?

Sub-question 1: an acceptable solution for me would be to invalidate each FedAuth cookie (on each RP), which means I just have to perform a massive sign-out out of all the RPs. Any thoughts on this, perhaps?

Answer 1

There's nothing explicitly in the WS-Fed protocol for this. Think about it -- it's like a driver's license -- how can the DMV invalidate your license? They'd need some back-channel and not every RP would be in a position to check.

Perhaps you could trigger a signoutcleanup from the IdP -- that's certainly possible and would achieve what you're looking for in a forceful way.