<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Filip Skokan proposed changing the names to allowed_* which more reflects the intent.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 2 Aug 2018, at 23:31, Mike Schwartz via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class="">Actually the OP publishes "scopes_supported" and "claims_supported"<br class=""><br class="">Roland proposed adding "rp_scopes" and "rp_claims" to metadata statements<br class=""><br class="">But neither of these say what claims or scopes are supported by the federation, as you do on this page: <a href="https://www.incommon.org/federation/attributes.html" class="">https://www.incommon.org/federation/attributes.html</a><br class=""></div></div></blockquote><div><br class=""></div>The federation when signing the metadata statement for an entity/organisation belonging to the federation</div><div>may add allowed_* claims to specify what scopes/claims can be used by that entity/organisation.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">- Mike<br class=""><br class=""><br class="">------------------------<br class="">Michael Schwartz<br class="">Gluu<br class="">Founder / CEO<br class=""><a href="mailto:mike@gluu.org" class="">mike@gluu.org</a><br class="">https://www.linkedin.com/in/nynymike/<br class=""><br class="">On 2018-08-02 15:33, Nick Roy wrote:<br class=""><blockquote type="cite" class="">On 8/2/18 2:10 PM, Mike Schwartz via Openid-specs-ab wrote:<br class=""><blockquote type="cite" class="">Andreas,<br class="">First question, how did you get twitter handle @erlang ?<br class="">Here are some comments, just prima facie:<br class="">1. I like the idea to leverage Webfinger. One of my core concerns about<br class="">he current OIDC federation draft is that it's too static in a day and<br class="">age when we're all using lots of API's. And WebFinger is already used by<br class="">OP's that support dynamic configuration, so why not use it? But one<br class="">question I have is public clients, for example a javascript application<br class="">running in the browser can't host a Webfinger endpoint.<br class="">2. Wouldn't it be better for the client to present it's metadata during<br class="">dynamic client registration, rather then requiring the OP to call back<br class="">to the RP's Webfinger URL at authentication time?<br class="">3. Are you also proposing the use of OP,RP metadata for signing_keys,<br class="">signing_keys_uri, and signed_jwks_uri ? Another federation challenge is<br class="">that key rotation for the jwks_uri happens frequently if you are<br class="">following guidelines for best practices (every two days).<br class="">4. What about metadata for the federation itself? Perhaps the federation<br class="">wants to publish certain guidelines, like what are the SAML attributes<br class="">it recommends its participants to support? For example, InCommon<br class="">recommends use of eduPerson.<br class=""></blockquote>Wouldn't that be handled by scopes in the metadata statement for the OP,RP?<br class="">Nick<br class=""><blockquote type="cite" class="">5. How would a client register with the federation to get that<br class="">persistent identifier? Or is that out of scope of your proposal?<br class="">6. Did you go through the inter-federation use case? Is the data<br class="">duplicated? Or does one federation refer back to the other federation?<br class="">- Mike<br class="">------------------------<br class="">Michael Schwartz<br class="">Gluu<br class="">Founder / CEO<br class="">mike@gluu.org<br class="">https://www.linkedin.com/in/nynymike/<br class="">_______________________________________________<br class="">Openid-specs-ab mailing list<br class="">Openid-specs-ab@lists.openid.net<br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></blockquote></blockquote>_______________________________________________<br class="">Openid-specs-ab mailing list<br class="">Openid-specs-ab@lists.openid.net<br class="">http://lists.openid.net/mailman/listinfo/openid-specs-ab<br class=""></div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">— Roland</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">The higher up you go, the more mistakes you are allowed. Right at the top, if you make enough of them, it's considered to be your style. </div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">-Fred Astaire, dancer, actor, singer, musician, and choreographer (10 May 1899-1987)</div></div>
</div>
<br class=""></body></html>