<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="font-family:Calibri,"Segoe UI",Meiryo,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Khmer UI","Nirmala UI",Tunga,"Lao UI",Ebrima,sans-serif;font-size:16px;">
<div>Let’s talk about this again on the Thursday call at 7:00am Pacific Time.</div>
<div> </div>
<div data-focusfrompointer="true">-- Mike</div>
<div data-focusfrompointer="true"> </div>
<div> </div>
<div style="border-top-color: rgb(229, 229, 229); border-top-width: 2px; border-top-style: solid;">
<strong>From:</strong> John Bradley<br>
<strong>Sent:</strong> December 19, 2012 2:34 PM<br>
<strong>To:</strong> openid-connect-interop@googlegroups.com<br>
<strong>CC:</strong> Breno de Medeiros, Mike Jones, openid-specs-ab@lists.openid.net<br>
<strong>Subject:</strong> Re: [Openid-specs-ab] Inconsistency between user_id and prn claims - notice of upcoming breaking change<br>
</div>
<div> </div>
Subject would be consistent with SAML. Principal is less common outside web services.
<div><br>
</div>
<div>But I really don't care much. There are more specs that need to be changed if it is changed to sub, however I don't think that is insurmountable at this point. </div>
<div>Once the JWT Assertions spec is done then it gets tough.</div>
<div><br>
</div>
<div>John B.</div>
<div><br>
<div>
<div>On 2012-12-19, at 6:45 PM, Justin Richer <<a href="mailto:jricher@mitre.org">jricher@mitre.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote>
<div>
<div class="moz-cite-prefix">On 12/19/2012 03:07 PM, Breno de Medeiros wrote:<br>
</div>
<blockquote>
<div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;">
<div dir="ltr">
<div class="gmail_default"><br>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Wed, Dec 19, 2012 at 11:09 AM, Mike Jones <span dir="ltr">
<<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">While of course you’re right that “prn” isn’t highly intuitive, neither are the contents of this particular claim. It will contain values not
intended for consumption by humans, such as 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4 – not values intended for human consumption such as
<a href="mailto:ben@livefyre.com">ben@livefyre.com</a>.</span></p>
<div><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">UID (or for that matter user_id) don’t work in the general case because the principal/subject may not be a user. It could be an OAuth client,
a service, etc.</span></p>
<div><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">FYI, “sbj” was discussed and rejected during the call because it’s really not any more intuitive than “prn” and if we use anything other than “prn”
we’d have to change two IETF specs as well (JWT and the OAuth JWT Assertion Profile).</span></p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>But neither of these other specs are final, right?</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Correct, and I think that Mike's claim is a little bit of a red herring. Making a change will have some friction, but not enough for it to be impossible. I would rather us have something that is intuitive to the intended audience -- developers. "sub", to me,
is more common and understandable than "prn". But I'm also not coming from a SAML or even a general Security Nerd background, where "principal" is used more often.<br>
<br>
-- Justin<br>
<br>
<blockquote>
<div style="font-family: arial,helvetica,sans-serif; font-size: 10pt;">
<div dir="ltr">
<div class="gmail_extra" data-focusfrompointer="true">
<div class="gmail_quote">
<div> </div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">
<div lang="EN-US">
<div>
<div><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"></span><br class="webkit-block-placeholder">
</div>
<div><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> -- Mike</span></p>
<div><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"><b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;">From:</span></b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;">
<a href="mailto:openid-connect-interop@googlegroups.com">openid-connect-interop@googlegroups.com</a> [mailto:<a href="mailto:openid-connect-interop@googlegroups.com">openid-connect-interop@googlegroups.com</a>]
<b>On Behalf Of </b>Benjamin Goering<br>
<b>Sent:</b> Tuesday, December 18, 2012 9:37 PM<br>
<b>To:</b> <a href="mailto:openid-connect-interop@googlegroups.com">openid-connect-interop@googlegroups.com</a><br>
<b>Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: Inconsistency between user_id and prn claims - notice of upcoming breaking change</span></p>
<div> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">`prn` doesn't map to anything intuitive to most non-expert hackers in the industry (IMHO), and `subj` would be better than `sub` (subscription). Is `uid` an option given knowledge of these other specs? Just my naive opinion.</p>
<div>
<div class="h5"><br>
<br>
On Monday, December 17, 2012 5:05:26 PM UTC-8, Mike Jones wrote:</div>
</div>
<div>
<div class="h5">
<div>
<div>
<p class="MsoNormal">Mitre and Microsoft implementers have both recently independently pointed out that an ID Token is not currently usable as an OAuth JWT Assertion because it uses the “user_id” claim to identify the subject of the token, rather than the “prn”
(principal) claim, as specified in the OAuth JWT Assertion spec. This inconsistency is already causing real problems/limitations for implementations. See
<a href="http://hg.openid.net/connect/issue/687">http://hg.openid.net/connect/issue/687</a> for more background on the issue.</p>
<div> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">This was discussed on the working group call today and it was decided that while changing the “user_id” claim name now would be painful, it would be more painful over time to keep having implementer’s try to work around this inconsistency
when they need to use an ID Token as an OAuth JWT assertion. Therefore, we decided that the specs should be changed so that an ID Token is a legal OAuth JWT Assertion. The simplest way to do this would be to change all uses of the claim name “user_id” to
“prn”. Only the syntax would change – not the meaning of the claim.</p>
<div> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">The other potential solution that was discussed was to change both the names “user_id” and “prn” to “sub” (subject). While being a (somewhat) more meaningful name, using “prn” was preferred because it will involve a change only to the
Connect specs – not also to the JWT and OAuth JWT Assertion specs.</p>
<div> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal">The participants in the working group call decided that we should make this change, but we wanted to give clear notice to the working group and interop participants of this upcoming breaking change. If you would like to propose an alternative
solution to the inconsistency, please do so before the Thursday OpenID Connect call. We plan to include this change in the upcoming implementer’s drafts.</p>
<div> <br class="webkit-block-placeholder">
</div>
<p class="MsoNormal"> -- Mike</p>
<div> <br class="webkit-block-placeholder">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
--Breno<br>
<br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre>_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</body>
</html>