<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body >Hi Mike,<div><br></div><div>I prefer "prn".</div><div><br></div><div>Regards, </div><div>Torsten. </div><br>Mike Jones <Michael.Jones@microsoft.com> hat geschrieben:<br>Just to remove any ambiguity, was your +1 for "prn" or "sub", Torsten?<br><br> -- Mike<br><br>-----Original Message-----<br>From: openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net] On Behalf Of Torsten Lodderstedt<br>Sent: Tuesday, December 18, 2012 10:54 AM<br>To: Justin Richer<br>Cc: openid-specs-ab@lists.openid.net<br>Subject: Re: [Openid-specs-ab] Inconsistency between user_id and prn claims - notice of upcoming breaking change<br><br>+1<br><br>Am 18.12.2012 16:10, schrieb Justin Richer:<br>> +1, though I prefer "sub" over "prn" as it reads better.<br>><br>> -- Justin<br>><br>> On 12/18/2012 03:37 AM, Vladimir Dzhuvinov / NimbusDS wrote:<br>>> +1 for prn. Consistency with OAuth JWT assertion makes good sense.<br>>><br>>> Thanks,<br>>><br>>> Vladimir<br>>><br>>> --<br>>> Vladimir Dzhuvinov : www.NimbusDS.com : vladimir@nimbusds.com<br>>><br>>><br>>> -------- Original Message --------<br>>> Subject: [Openid-specs-ab] Inconsistency between user_id and prn <br>>> claims<br>>> - notice of upcoming breaking change<br>>> From: Mike Jones <Michael.Jones@microsoft.com><br>>> Date: Tue, December 18, 2012 1:05 am<br>>> To: "openid-specs-ab@lists.openid.net"<br>>> <openid-specs-ab@lists.openid.net><br>>> Cc: "openid-connect-interop@googlegroups.com"<br>>> <openid-connect-interop@googlegroups.com><br>>><br>>> Mitre and Microsoft implementers have both recently independently <br>>> pointed out that an ID Token is not currently usable as an OAuth JWT <br>>> Assertion because it uses the “user_id” claim to identify the subject <br>>> of the token, rather than the “prn” (principal) claim, as specified <br>>> in the OAuth JWT Assertion spec. This inconsistency is already <br>>> causing real problems/limitations for implementations. See<br>>> http://hg.openid.net/connect/issue/687 for more background on the issue.<br>>> This was discussed on the working group call today and it was <br>>> decided that while changing the “user_id” claim name now would be <br>>> painful, it would be more painful over time to keep having <br>>> implementer’s try to work around this inconsistency when they need to <br>>> use an ID Token as an OAuth JWT assertion. Therefore, we decided <br>>> that the specs should be changed so that an ID Token is a legal OAuth <br>>> JWT Assertion. The simplest way to do this would be to change all <br>>> uses of the claim name “user_id” to “prn”. Only the syntax would <br>>> change – not the meaning of the claim.<br>>> The other potential solution that was discussed was to change <br>>> both the names “user_id” and “prn” to “sub” (subject). While being a<br>>> (somewhat) more meaningful name, using “prn” was preferred because it <br>>> will involve a change only to the Connect specs – not also to the JWT <br>>> and OAuth JWT Assertion specs.<br>>> The participants in the working group call decided that we <br>>> should make this change, but we wanted to give clear notice to the <br>>> working group and interop participants of this upcoming breaking <br>>> change. If you would like to propose an alternative solution to the <br>>> inconsistency, please do so before the Thursday OpenID Connect call. <br>>> We plan to include this change in the upcoming implementer’s drafts.<br>>> -- Mike<br>>> _______________________________________________<br>>> Openid-specs-ab mailing list<br>>> Openid-specs-ab@lists.openid.net<br>>> http://lists.openid.net/mailman/listinfo/openid-specs-ab<br>>> _______________________________________________<br>>> Openid-specs-ab mailing list<br>>> Openid-specs-ab@lists.openid.net<br>>> http://lists.openid.net/mailman/listinfo/openid-specs-ab<br>><br>> _______________________________________________<br>> Openid-specs-ab mailing list<br>> Openid-specs-ab@lists.openid.net<br>> http://lists.openid.net/mailman/listinfo/openid-specs-ab<br><br>_______________________________________________<br>Openid-specs-ab mailing list<br>Openid-specs-ab@lists.openid.net<br>http://lists.openid.net/mailman/listinfo/openid-specs-ab<br></body>