<div dir="ltr">The choice the RP has in that context is to fail the authentication. I could see some RPs/SPs choosing to ask for the number and then doing a phone number verification themselves (SMS loop). It totally depends on the identity proofing requirements of the RP:)<div><br></div><div>It would be better for the MNO OPs to support the "claims" parameter which allows the RP to specify a given claim as "essential" and if the user choses to not provide the essential claim, the authentication fails.</div><div><br></div><div>Even in this case, the RP is still responsible for what the UX should be for such a use case. Maybe they chose to do a local registration instead of Mobile Connect?</div><div><br></div><div>Thanks,<br>George<br><br><div class="gmail_quote"><div dir="ltr">On Wed, Aug 29, 2018 at 2:57 PM Engan, Michael <<a href="mailto:Michael.Engan1@t-mobile.com">Michael.Engan1@t-mobile.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-4549721723178740184WordSection1">
<p class="MsoNormal">That would work for me. I still believe it should be an SP task to stitch the user experience. But I would probably have to disagree with the single “Phone_number” attribute. If an SP sends you to the MNO to authenticate, and the SP
wants your phone number. (with signed assertion from the carrier that the phone number is accurate) it would not make sence for the SP to ask the user for their phone number instead.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Hjelm, Bjorn <Bjorn.Hjelm@VerizonWireless.com> <br>
<b>Sent:</b> Wednesday, August 29, 2018 11:53 AM<br>
<b>To:</b> Engan, Michael <Michael.Engan1@T-Mobile.com>; <a href="mailto:openid-specs-mobile-profile@lists.openid.net" target="_blank">openid-specs-mobile-profile@lists.openid.net</a>; Fletcher, George <<a href="mailto:george.fletcher@oath.com" target="_blank">george.fletcher@oath.com</a>><br>
<b>Cc:</b> GORHAM, MARIA C <<a href="mailto:mg1928@att.com" target="_blank">mg1928@att.com</a>><br>
<b>Subject:</b> RE: [E] [Openid-specs-mobile-profile] Question: mandatory vs Optional Scopes<u></u><u></u></p>
</div>
</div></div></div><div lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_-4549721723178740184WordSection1">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">The RP would state that a given "claim" is essential but would require the OP to support the
</span><span style="font-family:"Courier New";color:#1f497d"><a href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" target="_blank">claims<span style="font-family:"Calibri",sans-serif"> parameter</span></a></span><span style="color:#1f497d">. It’s worth
noting that the “</span><tt><span lang="EN" style="font-size:10.0pt;color:#1f497d">claims_parameter_supported</span></tt><span lang="EN" style="color:#1f497d"> Discovery result indicates whether the OP supports this parameter.”</span><span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">In talking to George, the general practice in a use case like this (where the RP asks for a set of attributes and the user choses to not provide them) that the RP would ask the user directly for those attributes
if they are required.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">BR,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Bjorn<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif"> Openid-specs-mobile-profile [<a href="mailto:openid-specs-mobile-profile-bounces@lists.openid.net" target="_blank">mailto:openid-specs-mobile-profile-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Engan, Michael<br>
<b>Sent:</b> Wednesday, August 29, 2018 10:52 AM<br>
<b>To:</b> <a href="mailto:openid-specs-mobile-profile@lists.openid.net" target="_blank">openid-specs-mobile-profile@lists.openid.net</a>; Hjelm, Bjorn<br>
<b>Cc:</b> GORHAM, MARIA C<br>
<b>Subject:</b> [E] [Openid-specs-mobile-profile] Question: mandatory vs Optional Scopes<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have has requests from marketing teams to review SP’s being able to define scopes as optional vs mandatory.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Today our assumptions are the scopes requested in an openid connect request are optional. If the SP for instance askes for
<u></u><u></u></p>
<p class="MsoNormal">Scopes=(openid email phone) the user could select/deselect email or phone.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Instead of the SP having to give the user an error that the user can’t proceed because one of the attributes was not provided, the SP could instead ask for a failed authentication for any scope being de-selected.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Is this a feature/experience that has come up with anyone else before?
<u></u><u></u></p>
<p class="MsoNormal">Is there any suggestion in how to support this without doing something too far off spec?
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:Tele-GroteskFet;color:#1f497d">Michael Engan <br>
</span><span style="font-size:9.0pt;font-family:Tele-GroteskHal;color:#1f497d">Principal Systems Architect,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Tele-GroteskHal;color:#1f497d">Authentication, Authorization, & API security</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:Tele-GroteskHal;color:#1f497d"><a href="https://maps.google.com/?q=12920+SE+38&entry=gmail&source=g">12920 SE 38</a><sup>th</sup> Street | Bellevue, WA 98006<br>
Direct <a href="tel:(425)%20383-2268" value="+14253832268" target="_blank">425-383-2268</a> | Mobile <a href="tel:(425)%20443-3463" value="+14254433463" target="_blank">425-443-3463</a></span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div></div></blockquote></div></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Identity Standards Architect<br>Identity Services Engineering, Oath Inc.<div>Mobile:+1-703-462-3494 Office:+1-703-265-2544</div></div></div>