<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Mitre and Microsoft implementers have both recently independently pointed out that an ID Token is not currently usable as an OAuth JWT Assertion because it uses the “user_id” claim to identify the subject of the token, rather than the “prn”
(principal) claim, as specified in the OAuth JWT Assertion spec. This inconsistency is already causing real problems/limitations for implementations. See
<a href="http://hg.openid.net/connect/issue/687">http://hg.openid.net/connect/issue/687</a> for more background on the issue.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This was discussed on the working group call today and it was decided that while changing the “user_id” claim name now would be painful, it would be more painful over time to keep having implementer’s try to work around this inconsistency
when they need to use an ID Token as an OAuth JWT assertion. Therefore, we decided that the specs should be changed so that an ID Token is a legal OAuth JWT Assertion. The simplest way to do this would be to change all uses of the claim name “user_id” to
“prn”. Only the syntax would change – not the meaning of the claim.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The other potential solution that was discussed was to change both the names “user_id” and “prn” to “sub” (subject). While being a (somewhat) more meaningful name, using “prn” was preferred because it will involve a change only to the
Connect specs – not also to the JWT and OAuth JWT Assertion specs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The participants in the working group call decided that we should make this change, but we wanted to give clear notice to the working group and interop participants of this upcoming breaking change. If you would like to propose an alternative
solution to the inconsistency, please do so before the Thursday OpenID Connect call. We plan to include this change in the upcoming implementer’s drafts.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> -- Mike<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>