<div dir="ltr"><div><div>Thanks Mike. <br><br></div>I think your second interpretation of the 3rd example is more consistent with what you've said previously about it. But neither is unreasonable, IMHO. I believe your interpretation of the 1st example is perfectly reasonable but I'd disagree that it's well defined. I don't see any text that directly associated the sub claim with the openid scope other than via indirectly thought the id token and requirements that the sub claim in the id token match the sub claim form the UserInfo endpoint. I'd forgotten about issue 671 but looking back at it reminded me that I think I disagree in principal on the implications of the decision made there. Also, all the text (<a href="https://bitbucket.org/openid/connect/commits/5aa754b1332d">https://bitbucket.org/openid/connect/commits/5aa754b1332d</a>) that John wrote in resolving 671, including some that would seem to directly contradict your your interpretation of the 1st example, has been replaced or deleted by other checkins in the last week or so. <br>
<br><br></div>Anyway, I'm not trying to nitpick or argue with you about these (though I realize the last paragraph might read that way, it's not the intent) but the meta-point I do want to make is that I honestly don't think the spec is unambiguously clear on many of these scope/response_type combinations. And maybe that's okay. But if there are any security implications (seems like maybe the 1st example could lead to trouble but I dunno) or there are or will be any interop tests, it should probably be tightened up. <br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Jan 27, 2013 at 7:53 PM, Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Actually rereading this, the third example doesn’t include the “openid” scope value, and so it’s entirely outside the realm of what OpenID Connect specifies.
It’s just an OAuth 2.0 request – not an OpenID Connect request. The “profile” scope value is only meaningful in this case if the two participants agree what it means. It’s meaning might have nothing to do with the OpenID Connect meaning of that value.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> Best wishes,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">openid-connect-interop@googlegroups.com</a> [mailto:<a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">openid-connect-interop@googlegroups.com</a>]
<b>On Behalf Of </b>Mike Jones<br>
<b>Sent:</b> Sunday, January 27, 2013 3:05 PM<br>
<b>To:</b> <a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">openid-connect-interop@googlegroups.com</a>; <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> RE: Messages -15 RC: what to do malformed or ambiguous requests?<u></u><u></u></span></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Here’s my take on the (good) questions that you raised, Brian…<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><br>
</span> response_type=token<br>
scope=openid<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This is meaningful and well-defined. It requests an access token for the OpenID UserInfo Endpoint but requests no ID Token. The “sub” claim must be made available
at the UserInfo endpoint.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><br>
</span> response_type=id_token<br>
scope=openid profile email address<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This is an error, because it requests that claims be returned via the UserInfo endpoint, but requests no access token by which to access those claims. John
applied the fix to <a href="https://bitbucket.org/openid/connect/issue/671/" target="_blank">https://bitbucket.org/openid/connect/issue/671/</a> to make it clear that an error should be returned in this case. (Please review the text of the change.
</span><span style="font-size:11.0pt;font-family:Wingdings;color:#1f497d">J</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">)<u></u><u></u></span></p>
<p class="MsoNormal"><br>
response_type=code<br>
scope=profile<u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Like the first example, this is well-defined.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">openid-connect-interop@googlegroups.com</a> [<a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">mailto:openid-connect-interop@googlegroups.com</a>]
<b>On Behalf Of </b>Brian Campbell<br>
<b>Sent:</b> Friday, January 25, 2013 1:54 PM<br>
<b>To:</b> <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>;
<a href="mailto:openid-connect-interop@googlegroups.com" target="_blank">openid-connect-interop@googlegroups.com</a><br>
<b>Subject:</b> Messages -15 RC: what to do malformed or ambiguous requests?<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">There are a number of possible combinations of parameters that seem (at least to me) like they might be considered malformed or ambiguous. A few examples are listed below but there are other combinations, usually
where what's requested by the response type is somehow misaligned with what's requested via scope. The messages spec gives some guidance, for example around scope in 2.4 and the openid scope value in 2.4 but it's still not entirely clear what the expected
behavior is for these kind of things. I know this question, or variations on it, have come up before but I don't know that an answer was ever settled on. And it's still not clear to me from reading RC/-15.
<u></u><u></u></p>
</div>
<p class="MsoNormal">Is there a general expectation of behavior around this kind of thing? Should the AS just make a best effort? Or should it return errors to the client? Or something else? Even if the specs decide to leave it entirely up to the implementations,
I think it'd be useful to say as much.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Some example combinations of response_type and scope that I don't know what to do with:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br>
response_type=token<br>
scope=openid<br>
<br>
response_type=id_token<br>
scope=openid profile email address<br>
<br>
response_type=code<br>
scope=profile<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">-- <br>
<br>
<u></u><u></u></p>
</div></div></div>
</div>
<p></p>
-- <br>
<br>
<br>
</blockquote></div><br></div>