[Openid-specs-ab] What is the relationship between scope and user info claims ?

[John Bradley]

The claims specified by the scope are all optional.

If you want a particular claim to be required you use the claim request to override the scope.

The elements of the request object always override unsigned elements.

John
On 2011-09-16, at 9:21 AM, Roland Hedberg wrote:

> So when I use userinfo:claims I can specify that returning an attribute is optional.
> What it is the default when using scope, is everything default or required ?
> 
> If it is 'optional' (which seems reasonable) then userinfo:claims could be used to raise the 'necessity' to return an attribute ?
> If it is 'required' then can userinfo:claims be used to lower the 'necessity' ?
> 
> -- Roland
> 
> 16 sep 2011 kl. 08:55 skrev John Bradley:
> 
>> AND should be applied.
>> 
>> The three scopes for the user-info endpoint are to be thought of as convience shorthand for specifying the same info as claims in the request object.
>> 
>> John
>> On 2011-09-15, at 11:49 PM, Roland Hedberg wrote:
>> 
>>> Hi!
>>> 
>>> In an authorization request scope can be defined to be for instance profile which is interpreted as being equal to a claim for all person attributes except for email and address.
>>> In an Openid Request object you can list specific attributes your interested in in the userinfo:claims part.
>>> 
>>> So what relationship are there between these ?
>>> 
>>> Does any of them take precedence or should an AND be applied or … ?
>>> 
>>> -- Roland
>>> _______________________________________________
>>> Openid-specs-ab mailing list
>>> Openid-specs-ab at lists.openid.net
>>> http://lists.openid.net/mailman/listinfo/openid-specs-ab
>> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4767 bytes
Desc: not available
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20110919/06f22515/attachment.p7s>