<div dir="ltr">I don’t know. We are hearing strong demands from potential users of our IDP services for some metric of auth strength. They tend to have very specific demands. We’re not convinced that something as simple as “Did they use 2-factor?” is going to do the trick and there’s a lot of interesting work going on in this space. So what I’m concerned with is that when new strength metrics arise, OIDC won’t get in the way of the RP asking for particular values, nor of the OP describing its view of strength. -T<br>
<br><div class="gmail_extra">On Mon, Aug 12, 2013 at 1:49 PM, Anthony Nadalin <span dir="ltr"><<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>></span> wrote:<br><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">In some cases the RP may not understand all what the IdP is saying, like state of the session, the RP may not deal or care with session state, may only deal
with authentication strength and relies on short lived tokens for enforcing sessions, so what would you expect the RP to do with the combined URI in your example?<u></u><u></u></span></p>
<p class="MsoNormal"><a name="140744aa10c048f0__MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></a></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Tim Bray [mailto:<a href="mailto:tbray@textuality.com" target="_blank">tbray@textuality.com</a>]
<br>
<b>Sent:</b> Monday, August 12, 2013 1:46 PM<br>
<b>To:</b> Anthony Nadalin<br>
<b>Cc:</b> <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] acr values<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">An RP. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Mon, Aug 12, 2013 at 1:30 PM, Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" target="_blank">tonynad@microsoft.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Who do you want to say something about the “session strength” to?
</span><u></u><u></u></p>
<p class="MsoNormal"><a name="140744aa10c048f0_140743900e136421__MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></a><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Tim Bray<br>
<b>Sent:</b> Monday, August 12, 2013 1:05 PM<br>
<b>To:</b> <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> [Openid-specs-ab] acr values</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">In our IDP role, we’re coming under a lot of pressure to say something about “session strength” and maybe in some circumstances force re-auth and so on. There are a lot of different
vocabularies in play that you could use to talk about this stuff, including NIST and ISO publications; and the work of the Fido alliance is maybe interesting. So I expect a lot of churn in this space, and OIDC needs to allow sufficient elbow room.<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">So, the purpose of this note is to confirm my understandings, based on looking at the OIDC Messages draft. Do people agree with these?<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">- It’s perfectly OK to provide any old URI we dream up as a value for the “acr” claim.<u></u><u></u></p>
</div>
<p class="MsoNormal">- There may be awkwardness around multiple values; suppose I wanted to assert, for example, that the session is less than ten minutes old AND two-factor authent was used. All
I can think of is composing a URI along the lines of urn:google-auth-claims?max-age=10&two-factor=true; which is a little kludgy but I guess OK. Awkward, though, in the case where there’s a Fido vocabulary for 2-factor-flavor and someone else’s vocabulary
for session-freshness.<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
</blockquote></div><br></div></div>