<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap: break-word;-webkit-nbsp-mode: space;-webkit-line-break: after-white-space">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">> My hope was that by making sector_identifier_uri mandatory we would get rid of all the special cases with jwks_uri and
whatnot.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">> Isn’t that true?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">No.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">> So if someuses CIBA then there MUST be a siu at registration time and CIBA does not care how that is validated.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">> Making my life too easy?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Wishful thinking, Axel ;)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">An OP needs proof that an app is
<i>entitled</i> to use a sector_id before revealing the subs associated with that sector_id.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">A new app merely quoting a sector_id in its registration is not proof. It shows the app wants that sector_id, but it doesn’t
show that the other apps using that sector_id want to share subs with this new app. It doesn’t prevent a malicious app quoting another group’s sector_id.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">So the content at a sector_identifier_uri needs to identity each app that is entitled to use that sector_id (host part
of siu). It does so by listing a URI that each app needs to control to operate. For “normal” OIDC an app’s redirect_uri is sufficient; for CIBA with notifications an app’s client_notification_endpoint is sufficient; for CIBA with polling and asymmetric signatures
an app’s jwks_uri is sufficient; for other cases the tuple {iss, client_id} could work.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Hence CIBA needs to add that, at registration, the OP needs to confirm that siu lists client_notification_endpoint (to
enabling notifications) or jwks_uri (to enabling polling with asym sigs).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US">James Manger<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> John Bradley [mailto:ve7jtb@ve7jtb.com]
<br>
<b>Sent:</b> Donnerstag, 8. Juni 2017 18:56<br>
<b>To:</b> Nennker, Axel <Axel.Nennker@telekom.de><br>
<b>Cc:</b> openid-specs-mobile-profile@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-mobile-profile] Issue 52 CIBA Pairwise Identifiers Structuring Text<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="DE">Validation of the sector identifier is part of registration.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">The client registers its client_notification_endpoint as a new element. (Shouldn't that be an array vs a single URI if the request allows notification_uri to be specified? otherwise why send it in the request?)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">The registration process needs to check those URI against the URI in the JSON file returned from the sector_identifier_uri.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">I dont think registration is going to get updated anytime soon so it probably needs to be explained in this spec for those IDP that allow notifiction_uri to be specified.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">All AS should always use the sector_identifier_uri as the key for generating ppid. Nothing in that changes.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">I think for the polling we need to specify the client JWKS endpoint in the sector_identifier_uri as well.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">It is just a URI so that should not be an issue. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">If the registered jwks uri is not in the file then don’t allow polling. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">I know this precludes the use of symmetric keys but I think that may be a reasonable trade off if someone wants to use this with polling.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE">John B.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="DE">On Jun 8, 2017, at 3:38 AM, <<a href="mailto:Axel.Nennker@telekom.de">Axel.Nennker@telekom.de</a>> <<a href="mailto:Axel.Nennker@telekom.de">Axel.Nennker@telekom.de</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hi all,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">can this issue be closed?</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text"><span style="color:#954F72">https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text</span></a></span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">The sector_identifier_url is now mandatory to be specified at Client registration time.</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Validation of the sector_identifier is out-of-scope for CIBA and should be in Discovery.</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Please comment on the issue in bitbucket or here.</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Kind regards</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Axel</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif">DEUTSCHE TELEKOM AG</span></b><span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif"><br>
T-Labs (Research & Innovation)<br>
Axel Nennker<br>
Winterfeldtstr. 21, 10781 Berlin<br>
+491702275312 (Tel.)</span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:8.0pt;font-family:"Arial",sans-serif">E-Mail:<span class="apple-converted-space"> </span><a href="mailto:axel.nennker@telekom.de"><span style="color:#954F72">axel.nennker@telekom.de</span></a></span><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="DE" style="font-size:9.0pt;font-family:"Helvetica",sans-serif">_______________________________________________<br>
Openid-specs-mobile-profile mailing list<br>
</span><span lang="DE"><a href="mailto:Openid-specs-mobile-profile@lists.openid.net"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72">Openid-specs-mobile-profile@lists.openid.net</span></a></span><span lang="DE" style="font-size:9.0pt;font-family:"Helvetica",sans-serif"><br>
</span><span lang="DE"><a href="http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile"><span style="font-size:9.0pt;font-family:"Helvetica",sans-serif;color:#954F72">http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile</span></a><o:p></o:p></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="DE"><o:p> </o:p></span></p>
</div>
</div>
</div>
</body>
</html>