<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yes I meant that that it would be called sub-object or something other than sub.<div class=""><br class=""></div><div class="">Leave sub for the simple case as it is defined now as being global unique or scoped to its.</div><div class=""><br class=""></div><div class="">Add a new claim for values that are not.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">In principal depending on the message you could have a simple sub scoped to issuer but also have multiple sub-objects that are aliases for email/phone etc. </div><div class=""><br class=""></div><div class="">Perhaps that is a better way to think about the more complicated case where what you have is one or more aliases for the sub that may be scoped or formatted in ways that the consumer understands in its context.</div><div class=""><br class=""></div><div class="">So a sub stays a sub, and is optional but we have a new sub-alias object.</div><div class=""><br class=""></div><div class="">John B.<br class=""><div><blockquote type="cite" class=""><div class="">On Aug 3, 2017, at 12:51 PM, Phil Hunt <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yes. I have often used the term “complex” or “composite” attributes. An attribute whose value is a JSON object with one or more attributes such as type.<div class=""><br class=""><div class="">I think one concern (not mine) is that people do not want to change how “sub” is traditionally used as defined in Connect. The concern has been expressed as to object to any change even at the SET token level.</div><div class=""><br class=""></div><div class="">If we go the composite/dictionary route, calling it “identity” or something else might be more acceptable.</div><div class=""><br class=""></div><div class="">If it is generic enough, I would support having this in the SET Token draft where the issue is still being discussed.</div><div class=""><br class=""></div><div class="">What I really want to avoid is complexity whereby the connect method or the new method could be optionally used. If we make this a SET thing, than all profiles SHOULD work the same. I use SHOULD because it depends on what the spec would say about the dictionary/sub-attributes.</div><div class=""><br class=""><div class="">
<div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">Oracle Corporation, Identity Cloud Services Architect & Standards</div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com/" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br class=""><div class=""><blockquote type="cite" class=""><div class="">On Aug 3, 2017, at 9:42 AM, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" class="">ve7jtb@ve7jtb.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I guess in principal sub could be a dictionary with a val and other meta data like a optional issuer.<div class=""><br class=""></div><div class="">We do that with sub in <a href="http://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests" class="">Connect claims requests</a>.</div><div class=""><br class=""></div><div class="">However in responses sub is defined in </div><div class=""><a href="https://tools.ietf.org/html/rfc7519#section-4.1.2" class="">https://tools.ietf.org/html/rfc7519#section-4.1.2</a> as a string.</div><div class=""><br class=""></div><div class="">One option might be to have a new claim. sub-d that is a dictionary that you could use when you need a more complicated sub with a SubjectNameIdFormat and scope. How could that go wrong:)</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""> <br class=""><div class=""><blockquote type="cite" class=""><div class="">On Aug 3, 2017, at 12:19 PM, Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class=""><div class="">Lets not forget that we also have cases where subject is identified by email or telephone or other identifier (implicit fed cases). </div><div class=""><br class=""></div><div class="">Risc needs to have a subject type attribute to inform parsers how to identify the subject. The next question whether sub gets re-used as a general purpose attribute or whether specific attributes are used for each type (email, telephone). <br class=""><br class="">In solving this broader requirement the sub/iss problem may also be resolved. </div><div class=""><br class="">Phil</div><div class=""><br class="">On Aug 3, 2017, at 1:52 AM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" class="">sakimura@gmail.com</a>> wrote:<br class=""><br class=""></div><blockquote type="cite" class=""><div class=""><p dir="ltr" class="">My preference: If all SET only supports a single iss/sub pair, then 1. If a SET can have events for multiple iss/sub pair, then 2. </p>
<br class=""><div class="gmail_quote"><div dir="ltr" class="">2017年8月3日(木) 7:49 Marius Scurtescu <<a href="mailto:mscurtescu@google.com" class="">mscurtescu@google.com</a>>:<br class=""></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">Each SET profile must define or clarify several aspects of the specs. For RISC most of these must only be only specified (like key resolution), but there is at least one issue for which we don't have an agreed on solution.<div class=""><br class=""></div><div class="">In some use cases the issuer of the SET is different from the issuer of the subject identifier, and at least in those cases there cannot be only one top level "iss" claim.</div><div class=""><br class=""></div><div class="">Here are the proposals I am aware of to solve this issue:</div><div class=""><br class=""></div><div class="">1. Move iss+sub to the event level. The drawback of this approach is redundancy when multiple events are present in the SET.</div><div class=""><br class=""></div><div class=""><div class=""><font face="monospace, monospace" class="">{</font></div><div class=""><font face="monospace, monospace" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</font></div><div class=""><font face="monospace, monospace" class=""> "iat": 1458496025,</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://tr.example.com/" target="_blank" class="">https://tr.example.com</a>",</font></div><div class=""><font face="monospace, monospace" class=""> "aud": "</font><span style="font-family:monospace,monospace" class=""><a href="https://rv.example.com/" target="_blank" class="">https://rv.example.com/</a>",</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "events": {</font></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:sessions-revoked":</font></div><div class=""><font face="monospace, monospace" class=""> {</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><span style="font-family:monospace,monospace" class=""> },</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:tokens-revoked":</font></div><div class=""><font face="monospace, monospace" class=""> {</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><span style="font-family:monospace,monospace" class=""> }</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> }</font></div><div class=""><span style="font-family:monospace,monospace" class="">}</span><br class=""></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">1.1 Move only the subject "iss" to the event level and leave "sub" at the top level (next to the SET "iss"). I find this solution very confusing.</div><div class=""><br class=""></div><div class=""><div class=""><font face="monospace, monospace" class="">{</font></div><div class=""><font face="monospace, monospace" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</font></div><div class=""><font face="monospace, monospace" class=""> "iat": 1458496025,</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://tr.example.com/" target="_blank" class="">https://tr.example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "aud": "</font><span style="font-family:monospace,monospace" class=""><a href="https://rv.example.com/" target="_blank" class="">https://rv.example.com/</a>",</span></div><div class=""><font face="monospace, monospace" class=""> "events": {</font></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:sessions-revoked":</font></div><div class=""><font face="monospace, monospace" class=""> {</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> },</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:tokens-revoked":</font></div><div class=""><font face="monospace, monospace" class=""> {</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> }</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> }</font></div><div class=""><span style="font-family:monospace,monospace" class="">}</span></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">2. Move iss+sub immediately under the "events" claim. No redundancy in this case.</div><div class=""><br class=""></div><div class=""><div class=""><font face="monospace, monospace" class="">{</font></div><div class=""><font face="monospace, monospace" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</font></div><div class=""><font face="monospace, monospace" class=""> "iat": 1458496025,</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://tr.example.com/" target="_blank" class="">https://tr.example.com</a>",</font></div><div class=""><font face="monospace, monospace" class=""> "aud": "</font><span style="font-family:monospace,monospace" class=""><a href="https://rv.example.com/" target="_blank" class="">https://rv.example.com/</a>",</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "events": {</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:sessions-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">},</span></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:tokens-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">}</span></div><div class=""><font face="monospace, monospace" class=""> }</font></div><div class=""><span style="font-family:monospace,monospace" class="">}</span></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">3. Move iss+sub to a new nested claim.</div><div class=""><br class=""></div><div class=""><div class=""><font face="monospace, monospace" class="">{</font></div><div class=""><font face="monospace, monospace" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</font></div><div class=""><font face="monospace, monospace" class=""> "iat": 1458496025,</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://tr.example.com/" target="_blank" class="">https://tr.example.com</a>",</font></div><div class=""><font face="monospace, monospace" class=""> "aud": "</font><span style="font-family:monospace,monospace" class=""><a href="https://rv.example.com/" target="_blank" class="">https://rv.example.com/</a>",</span><br class=""></div><div class=""><span style="font-family:monospace,monospace" class=""> "target": {</span></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><span style="font-family:monospace,monospace" class=""> },</span></div><div class=""><font face="monospace, monospace" class=""> "events": {</font></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:sessions-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">},</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:tokens-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">}</span></div><div class=""><font face="monospace, monospace" class=""> }</font></div><div class=""><span style="font-family:monospace,monospace" class="">}</span></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">4. Define a new top level issuer claim either for the SET or for the subject.</div><div class=""><br class=""></div><div class=""><div class=""><font face="monospace, monospace" class="">{</font></div><div class=""><font face="monospace, monospace" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</font></div><div class=""><font face="monospace, monospace" class=""> "iat": 1458496025,</font></div><div class=""><font face="monospace, monospace" class=""> "iss": "<a href="https://tr.example.com/" target="_blank" class="">https://tr.example.com</a>",</font></div><div class=""><font face="monospace, monospace" class=""> "iss-sub": "<a href="https://example.com/" target="_blank" class="">https://example.com</a>",</font></div><div class=""><span style="font-family:monospace,monospace" class=""> "sub": "47635747",</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "aud": "</font><span style="font-family:monospace,monospace" class=""><a href="https://rv.example.com/" target="_blank" class="">https://rv.example.com/</a>",</span><br class=""></div><div class=""><span style="font-family:monospace,monospace" class=""> "events": {</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:sessions-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">},</span><br class=""></div><div class=""><font face="monospace, monospace" class=""> "urn:ietf:params:risc:event:tokens-revoked": </font><font face="monospace, monospace" class="">{</font><span style="font-family:monospace,monospace" class="">}</span></div><div class=""><font face="monospace, monospace" class=""> }</font></div><div class=""><span style="font-family:monospace,monospace" class="">}</span></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">An open question is if this new iss+sub solution should be always required or if a top level iss+sub should also be allowed (when there is no conflict). I vote for having only one way for simplicity.</div><div class=""><br class=""></div><div class="">Once we decide on a solution we can start working on the RISC profile draft.</div><div class=""><br class=""></div><div class="">Thoughts?</div><div class=""><br class=""></div><div class=""><div class="">Marius
</div></div></div>
_______________________________________________<br class="">
Openid-specs-risc mailing list<br class="">
<a href="mailto:Openid-specs-risc@lists.openid.net" target="_blank" class="">Openid-specs-risc@lists.openid.net</a><br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Drisc&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oELWrk4I8hITS0xtNBEzkxMNmGjdHfFGkwNTJluxMQM&s=WH0oHORcbz6GzolvV9301ap4nCL-qYRmD7wWIWPJnL8&e=" rel="noreferrer" target="_blank" class="">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a><br class="">
</blockquote></div><div dir="ltr" class="">-- <br class=""></div><div class="gmail_signature" data-smartmail="gmail_signature"><p dir="ltr" class="">Nat Sakimura</p><p dir="ltr" class="">Chairman of the Board, OpenID Foundation</p>
</div>
</div></blockquote><blockquote type="cite" class=""><div class=""><span class="">_______________________________________________</span><br class=""><span class="">Openid-specs-risc mailing list</span><br class=""><span class=""><a href="mailto:Openid-specs-risc@lists.openid.net" class="">Openid-specs-risc@lists.openid.net</a></span><br class=""><span class=""><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Drisc&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oELWrk4I8hITS0xtNBEzkxMNmGjdHfFGkwNTJluxMQM&s=WH0oHORcbz6GzolvV9301ap4nCL-qYRmD7wWIWPJnL8&e=" class="">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Drisc&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oELWrk4I8hITS0xtNBEzkxMNmGjdHfFGkwNTJluxMQM&s=WH0oHORcbz6GzolvV9301ap4nCL-qYRmD7wWIWPJnL8&e=</a> </span><br class=""></div></blockquote></div>_______________________________________________<br class="">Openid-specs-risc mailing list<br class=""><a href="mailto:Openid-specs-risc@lists.openid.net" class="">Openid-specs-risc@lists.openid.net</a><br class=""><a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc" class="">http://lists.openid.net/mailman/listinfo/openid-specs-risc</a><br class=""></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></div></div></div></blockquote></div><br class=""></div></body></html>