<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
On 11/03/2020 09:42, Torsten Lodderstedt via Openid-specs-ekyc-ida
wrote:<br>
<blockquote type="cite"
cite="mid:E1E9DF9D-FC8B-408E-8A3C-71AD334FC71A@lodderstedt.net">
<pre class="moz-quote-pre" wrap="">Hi Nat,
we haven’t discussed this feature yet.
I think it makes sense to have that feature, especially if the RP obtained the authorization to access the user’s claims over a long time. I would assume an interesting use case would be to gather a larger set of data in the first request and update a sub set in subsequent transactions.
The use case you illustrated, on the other hand, I think, could raise interesting questions regarding data minimisation itself. Why should the RP ask for a broader data set than it needs for the use case at hand?</pre>
</blockquote>
<p>From what I understood Nat is interested in being able to
differentiate immutable (e.g. National ID Number) vs mutable (e.g.
address) claims. Then marking the first as "release once only".
I'm not sure how this can work with std OAuth access tokens
though.<br>
</p>
<p>Vladimir</p>
<blockquote type="cite"
cite="mid:E1E9DF9D-FC8B-408E-8A3C-71AD334FC71A@lodderstedt.net">
<pre class="moz-quote-pre" wrap="">
We can discuss in the call today.
best regards,
Torsten.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 11. Mar 2020, at 06:06, Nat Sakimura via Openid-specs-ekyc-ida <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ekyc-ida@lists.openid.net"><openid-specs-ekyc-ida@lists.openid.net></a> wrote:
Hi
I was wondering if it has already come up but I have a use-case where only a subset of (verified) claims are needed from time to time.
For example, I may need to get the Nationa ID number, address, DoB etc. in the first request, but in the subsequent request, I may just need the address as that is the only dynamic claim.
Presumably, I can use the previously obtained access token for this purpose as it is just down scoping, but I am not aware of a standardized way of sending "give me only this claim and nothing else" request to the Userinfo endpoint. From the data minimization point of view, this is pretty important.
Has this been discussed in this WG before?
Best,
Nat Sakimura
--
Openid-specs-ekyc-ida mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ekyc-ida@lists.openid.net">Openid-specs-ekyc-ida@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida">http://lists.openid.net/mailman/listinfo/openid-specs-ekyc-ida</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
Vladimir Dzhuvinov</pre>
</body>
</html>