<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body bgcolor="#FFFFFF">
<div style="font-size:11pt; font-family:Calibri,sans-serif">Introducing a second schema option violates the "keep it simple" principle, would confuse developers, and hurt interoperability. That way lies madness.<br>
</div>
<hr>
<span style="font-weight:bold; font-size:10pt; font-family:Tahoma,sans-serif">From:
</span><span style="font-size:10pt; font-family:Tahoma,sans-serif">George Fletcher</span><br>
<span style="font-weight:bold; font-size:10pt; font-family:Tahoma,sans-serif">Sent:
</span><span style="font-size:10pt; font-family:Tahoma,sans-serif">Wednesday, September 21, 2011 12:13 PM</span><br>
<span style="font-weight:bold; font-size:10pt; font-family:Tahoma,sans-serif">To:
</span><span style="font-size:10pt; font-family:Tahoma,sans-serif">John Bradley</span><br>
<span style="font-weight:bold; font-size:10pt; font-family:Tahoma,sans-serif">Cc:
</span><span style="font-size:10pt; font-family:Tahoma,sans-serif">Mike Jones; openid-specs-ab@lists.openid.net</span><br>
<span style="font-weight:bold; font-size:10pt; font-family:Tahoma,sans-serif">Subject:
</span><span style="font-size:10pt; font-family:Tahoma,sans-serif">Re: [Openid-specs-ab] Reserved member definitions</span><br>
<br>
<div><font face="Helvetica, Arial, sans-serif">Hi John,<br>
<br>
In looking at the most recent messages spec, it does not (at least in the userinfo section) discuss using claims with a namespace. Are you suggesting that the response would be something like...<br>
<br>
{<br>
<a class="moz-txt-link-rfc2396E" href="http://portablecontacts.net/ns/1.0">"http://portablecontacts.net/ns/1.0"</a>, { ... poco schema here ... }<br>
}<br>
<br>
or that each individual claim would be "prefixed" with the namespace. If this, then I can't find any test that says this is allowed or recommended. Maybe we should update the spec.<br>
<br>
Agreed that full poco support should be handled by a poco endpoint. <br>
<br>
Thanks,<br>
George<br>
</font><br>
On 9/21/11 1:29 PM, John Bradley wrote:
<blockquote type="cite">Portable contacts have a namespace: <span class="Apple-style-span" style="color:rgb(68,68,68); font-family:'courier new',monospace; font-size:13px; line-height:19px"><a href="http://portablecontacts.net/ns/1.0">http://portablecontacts.net/ns/1.0</a></span>
<div><font class="Apple-style-span" color="#444444" face="'courier
new', monospace"><span class="Apple-style-span" style="font-size:13px; line-height:19px"><br>
</span></font></div>
<div><span class="Apple-style-span" style="line-height:19px">They can all be used as claims in the request and response as the spec is now.<br>
</span></div>
<div>
<div>
<div><br>
</div>
<div>For supporting full portable contacts with sync and all of the other things, that is probably best done by publishing an additional poco endpoint.</div>
<div><br>
</div>
<div>John B.</div>
<div>On 2011-09-21, at 1:38 PM, George Fletcher wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div bgcolor="#FFFFFF"><font face="Helvetica, Arial, sans-serif">Sorry Mike, I wasn't meaning to suggest that we reverse the decision. Just thinking that with the schema parameter, there is an extension point. While an OP MUST support the openid schema it could
support other schemas. And so if an AS wants to support another schema it is easy to do.<br>
<br>
Thanks,<br>
George<br>
</font><br>
On 9/21/11 12:22 PM, Mike Jones wrote:
<blockquote type="cite">
<pre>Having multiple schemas hurts - not helps - interoperability. An explicit working group decision was made to move away from Portable Contact and to use a schema with lowercase_separated_by_underscores and names taken from Facebook Connect where they made sense, so as to make life easier for implementers who want to speak both OpenID Connect and Facebook Connect.
I believe that this was the right decision to help adoption and I'm strongly against reversing it now.
-- Mike
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a> [<a class="moz-txt-link-freetext" href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>] On Behalf Of Justin Richer
Sent: Wednesday, September 21, 2011 9:09 AM
To: George Fletcher
Cc: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Reserved member definitions
+1 poco
-- Justin
On Wed, 2011-09-21 at 12:06 -0400, George Fletcher wrote:
</pre>
<blockquote type="cite">
<pre>I still like the idea of 'schema=poco' and then the schema is defined
:)
On 9/20/11 6:57 PM, John Bradley wrote:
</pre>
<blockquote type="cite">
<pre>I took collision resistant namespace to be URI (including URN).
I don't know that for user-info endpoint interoperability we
necessarily want to go as far as JWT where almost anything is
allowed.
For openID connect we should require or strongly recommend URI for
claims. Otherwise we get IdP defining different semantics for the
same claim names.
John B.
On 2011-09-20, at 7:15 PM, Mike Jones wrote:
</pre>
<blockquote type="cite">
<pre>Actually, claim names need not be URIs. See Section 4 the JWT
spec, which allows the use of any of reserved claim names, public
claim names (which are to be taken from a collision-resistant
namespace), and private claim names (which can be any string at
all). The UserInfo claim names are actually an example of the use
of private claim names. Others could be used as well besides
those defined by the JWT and OpenID Connect Messages specs.
--
Mike
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a>
[<a class="moz-txt-link-freetext" href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>] On Behalf Of
John Bradley
Sent: Tuesday, September 20, 2011 2:44 PM
To: Roland Hedberg
Cc: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: Re: [Openid-specs-ab] Reserved member definitions
The schema is extended by using claims.
All claim names MUST be URI.
Just a small number of non URI strings are reserved in the schema
for common claims.
So yes you could use foaf or eduperson URI.
Perhaps that needs clarification.
John
On 2011-09-20, at 3:39 AM, Roland Hedberg wrote:
</pre>
<blockquote type="cite">
<pre>19 sep 2011 kl. 23:54 skrev John Bradley:
</pre>
<blockquote type="cite">
<pre>I am sympathetic to the position.
However without namespace support in JSON, we just end up
</pre>
</blockquote>
</blockquote>
<pre>adding extra characters to the reserved names for not much more
than formal correctness.
</pre>
<blockquote type="cite">
<pre>Yeah, that is a serious limitation to JSON.
</pre>
<blockquote type="cite">
<pre>The decision was to go for a fixed schema (implied namespace)
</pre>
</blockquote>
</blockquote>
<pre>and fully namespaces claims.
</pre>
<blockquote type="cite">
<pre>What do you mean with 'fully namespaces claims' ?
</pre>
<blockquote type="cite">
<pre>Perhaps being clear that all of the reserved claim names have a
</pre>
</blockquote>
</blockquote>
<pre>implied namespace that is not included in the JSON itself.
</pre>
<blockquote type="cite">
<pre>That would be important in the future.
OpenID Connect comes from OpenID which I have understood as
</pre>
</blockquote>
<pre>being geared towards individuals maintaining their net identity.
</pre>
<blockquote type="cite">
<pre>I've been think about what it would take to make OpenID Connect
</pre>
</blockquote>
<pre>usable in an organization context or for that matter in the
context of federations of organizations. Something which I'd like
to see as in scope.
</pre>
<blockquote type="cite">
<pre>And the first thing I stumble across is the lack of/limited
</pre>
</blockquote>
<pre>extensibility of the schema.
</pre>
<blockquote type="cite">
<pre>This is a major limitation.
There is just a matter of course that there isn't an
</pre>
</blockquote>
<pre>organization out there that doesn't have at least one attribute
that is specific to them (at least they think it is) that they
just have to have in an identity provider for it to be usable in
their context.
</pre>
<blockquote type="cite">
<pre>So having an implied namespace for the OpenID Connect attributes
</pre>
</blockquote>
<pre>could we allow for 'fully qualified' attributes from other
namespaces ?
</pre>
<blockquote type="cite">
<pre>For instance:
{
"name": "Jane Doe"
"given_name": "Jane",
"family_name": "Doe",
"email": <a class="moz-txt-link-rfc2396E" href="mailto:janedoe@example.com">"janedoe@example.com"</a>,
"picture": <a class="moz-txt-link-rfc2396E" href="http://example.com/janedoe/me.jpg">"http://example.com/janedoe/me.jpg"</a>,
<a class="moz-txt-link-rfc2396E" href="http://xmlns.com/foaf/0.1/title">"http://xmlns.com/foaf/0.1/title"</a>: "Ms"
}
-- Roland
</pre>
</blockquote>
</blockquote>
<pre>
_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
</blockquote>
<pre>_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote>
</div>
<br>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Chief Architect AIM: gffletch
Identity Services Engineering Work: <a class="moz-txt-link-abbreviated" href="mailto:george.fletcher@teamaol.com">george.fletcher@teamaol.com</a>
AOL Inc. Home: <a class="moz-txt-link-abbreviated" href="mailto:gffletch@aol.com">gffletch@aol.com</a>
Mobile: +1-703-462-3494 Blog: <a class="moz-txt-link-freetext" href="http://practicalid.blogspot.com">http://practicalid.blogspot.com</a>
Office: +1-703-265-2544 Twitter: <a class="moz-txt-link-freetext" href="http://twitter.com/gffletch">http://twitter.com/gffletch</a>
</pre>
</div>
</body>
</html>