<html><head/><body><html><head></head><body>Hi Eve,<br>
<br>
thanks for pointing this out. At first glance it seems to be feasable although I honestly don't know whether such an identifier would conflict with the OIDC semantics. <br>
<br>
To give you more context: I'm looking for a way to "just" assert a boolean claim to the RP. The use case, I'm currently investigating, is age verification. The RP wants the OP to attest whether the user is above 18. There is no session between RP and OP and the OP will typically not disclose any further data. I would prefer to realize this without the need to make up an identifier just to fulfill the protocol requirements.<br>
<br>
regards,<br>
Torsten.<br><br><div class="gmail_quote"><br>
<br>
Eve Maler <eve@xmlgrrl.com> schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre style="white-space: pre-wrap; word-wrap:break-word; font-family: sans-serif; margin-top: 0px">This sounds just like the justification for SAML's transient pseudonyms -- good only for the current session, handy for cases where the RP needs some sort of unique "handle" for internal user/session management, and useful for session timeouts or single logout a bit later on.<br /><br /> Eve<br /><br />On 30 Nov 2012, at 8:19 AM, Torsten Lodderstedt <torsten@lodderstedt.net> wrote:<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">We don't want the RP to track the user. So we would need to issue different user_id for every request. But I don't think is fit into the Connect philosophy.<br /><br />regards,<br />Torsten.<br /><br />Am 30.11.2012 17:11, schrieb Justin Richer:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Wo
uld
using pairwise identifiers make this work?<br /><br />-- Justin<br /><br />On 11/30/2012 11:09 AM, Torsten Lodderstedt wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #8ae234; padding-left: 1ex;">Hi,<br /><br />in some cases we want to provide RPs with attributes but no user_id, which is similar to AX. How can this be realized in Connect? The scope value "openid" activates the OpenID mode at the AS but it also requests access to the user_id Claim. If we do not want to disclose a user_id, does this mean we need to define a new, distinct scope for our use case, e.g. "attribute_x"?<br /><br />regards,<br />Torsten.<br /><hr /><br />Openid-specs-ab mailing list<br />Openid-specs-ab@lists.openid.net<br /><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote><br /></blockquote><hr /><br />Openid-specs-ab mailing list<br
/>Openid-specs-ab@lists.openid.net<br /><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></blockquote><br /><br />Eve Maler <a href="http://www.xmlgrrl.com/blog">http://www.xmlgrrl.com/blog</a><br />+1 425 345 6756 <a href="http://www.twitter.com/xmlgrrl">http://www.twitter.com/xmlgrrl</a><br /><br /><br /></pre></blockquote></div></body></html></body></html>