I'm just saying that for the simple case (IMHO) it would make more sense and be cleaner to define a request parameter for the flag rather than a special scope value. The request object can stay complicated for the complicated and granular cases.<br>
<br><div class="gmail_quote">On Tue, Jun 5, 2012 at 11:35 AM, John Bradley <span dir="ltr"><<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Per Mikes note, it will take a significant consensus to change the decision from the in person meeting.<div><br></div><div>We currently have a way to ask for the claims as part of the id_token, via the request object. That is still there, would adding an aditional OAuth parameter be an improvement over the request object?</div>
<div><br></div><div>The goal was having simple way to do it for basic clients. </div><div><br></div><div>John B.</div><div><div class="h5"><div><br></div><div><br><div><div>On 2012-06-05, at 1:13 PM, Brian Campbell wrote:</div>
<br><blockquote type="cite">I haven't thought though all the cases so this might be short sighted but it would seem that adding a new parameter to the request would be the way to go. As you say, id_token is already a divergence from OAuth so it seems reasonable to have a divergent parameter that toggles the claims that go in it.<br>
<br>So I guess my preference would be to add a new request param (probably named claims_in_id_token) to the authorization request along the lines of what's already being done for nonce, display, prompt, etc.<br> <br>
<br><div class="gmail_quote">On Tue, Jun 5, 2012 at 10:53 AM, John Bradley <span dir="ltr"><<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">I don't know that anyone is deeply attached to having it as a scope. The idea was to not require a request object.<div><br></div><div>Scopes implicitly specify the RS endpoint. This is sort of modifying the endpoint for other scopes, and I understand that is a touch awkward.</div>
<div><br></div><div>Would something like having separate scopes like:</div><div>email_id</div><div>profile_id</div><div>phone_id </div><div>address_id</div><div><br></div><div>If you ask for email it comes back from user_info and if you ask for email_id it is in the id_token.</div>
<div><br></div><div>Or is there something else you are thinking such as adding an extra parameter? We are trying not to diverge from OAuth as much as possible. (Yes I know id_token is a big divergence)</div><div><br></div>
<div>If people don't like the <span style="color:rgb(0,51,102);font-family:'Courier New'">claims_in_id_token </span><span style="background-color:transparent">scope then lets get alternate proposals on the table quickly.</span></div>
<div><br></div><div>John B.<br><div><br></div><div><div><div><div>On 2012-06-05, at 12:25 PM, Brian Campbell wrote:</div><br></div></div><blockquote type="cite"><div><div>I'm trying to understand why a scope was used to indicate the desire for user info claims to be returned in the ID Token? It really seems like something that should be isolated to a flag on the request (a new parameter or something in the request object). It feels out of place as a scope and will require ASs to have special conditional treatment of that one scope value (which I'd like to avoid as I'd think most implementers would). <br>
<br><br><div class="gmail_quote">On Sat, May 26, 2012 at 12:13 AM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US"><div>
<br>
<ul style="margin-top:0in" type="disc"><li class="MsoNormal"><span style="font-family:"Verdana","sans-serif"" lang="EN">Added scope value
</span><span style="font-family:"Courier New";color:#003366" lang="EN">claims_in_id_token</span><span style="font-family:"Verdana","sans-serif"" lang="EN"> as a switch to indicate that the UserInfo claims should be returned in the ID Token, per issue #561</span></li>
</ul></div></div></blockquote></div></div></div>
_______________________________________________<div><br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div></blockquote></div><br></div></div></blockquote></div><br>
</blockquote></div><br></div></div></div></div></blockquote></div><br>