<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Using real syntax to hopefully make things clear, the fallback position for discussion is that OPs would be required to understand request objects like this one, in which the request parameters are sent in the request object, rather
than as HTTP query parameters:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">{<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"response_type": "code id_token",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"client_id": "s6BhdRkqt3",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"redirect_uri": "https://client.example.org/cb",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"scope": "openid",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"state": "af0ifjsldkj",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"login_hint": "janedoe@example.org",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">}<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">OPs would be required to understand and act upon the "max_age" parameter and should also understand and process the "preferred_locales" parameter:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">{<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"userinfo":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "preferred_locales": ["en-US", "fr-CA"]<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> },<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"id_token":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "max_age": 86400<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">}<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">They would *not* be required to understand requests for specific claims, such as:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">{<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"userinfo":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "group_memberships": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "name": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "nickname": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "email": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "email_verified": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "picture": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "favorite_color": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "eye_color": null<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> },<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">"id_token":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "auth_time": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> "acr": { "values":["2"] }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New""> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New"">}<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Putting it all together into a request object using essentially every type of request parameter, the green parts would need to be understood and the red parts would not:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">{<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"response_type": "code id_token",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"client_id": "s6BhdRkqt3",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"redirect_uri": "https://client.example.org/cb",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"scope": "openid",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"state": "af0ifjsldkj",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"login_hint": "janedoe@example.org",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"userinfo":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> "preferred_locales": ["en-US", "fr-CA"],<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "group_memberships": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "name": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "nickname": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "email": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "email_verified": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "picture": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "favorite_color": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "eye_color": null<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> },<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">"id_token":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> "max_age": 86400,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "auth_time": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> "acr": { "values":["2"] }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:red"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-family:"Courier New";color:#00B050">}<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Having reviewed this, we might also choose to simplify this to the following – moving the “preferred_locales” and “max_age” parameters to the top level as follows. I’ll send a separate note about this. Then the example would become
the simpler:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:#00B050">{<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"response_type": "code id_token",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"client_id": "s6BhdRkqt3",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"redirect_uri": "https://client.example.org/cb",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"scope": "openid",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"state": "af0ifjsldkj",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"login_hint": "janedoe@example.org",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"preferred_locales": "en-US fr-CA",<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">"max_age": 86400,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red">"userinfo":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "preferred_locales": ["en-US", "fr-CA"],<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "group_memberships": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "name": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "nickname": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "email": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "email_verified": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "picture": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "favorite_color": null,<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "eye_color": null<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> },<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red">"id_token":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "claims":<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> {<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "auth_time": {"essential": true},<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> "acr": { "values":["2"] }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:red"> }<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#00B050">}<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hope this makes things concrete so that you can have a good discussion with your engineering team.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> -- Mike<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Tim Bray [mailto:tbray@textuality.com] <br>
Sent: Friday, February 01, 2013 8:09 AM<br>
To: Mike Jones<br>
Cc: openid-specs-ab@lists.openid.net<br>
Subject: Re: Possible MTI fallback position for OpenID Request Object</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On Thu, Jan 31, 2013 at 4:54 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com"><span style="color:windowtext;text-decoration:none">Michael.Jones@microsoft.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> As discussed on today’s call, it does several related things:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Actually, part of the gripe is that the things it does are not strongly/clearly related.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> The primary thing that some people on the call seemed to feel should
<o:p></o:p></p>
<p class="MsoPlainText">> not be Mandatory to Implement (MTI) functionality is having to respond
<o:p></o:p></p>
<p class="MsoPlainText">> to requests for specific individual claims.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Just to be clear: my engineering group wasn’t objecting to any one component in particular, just not wanting to take on the scaling and UX consequences of the whole package of fish-and-bicycles as specified in the current messages draft,
when we we think we can build a perfectly satisfactory and usable Internet-scale identity system without Request Objects.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> In summary the, middle ground that I’d like people to discuss is:<o:p></o:p></p>
<p class="MsoPlainText">> - Parsing OpenID Request Object MTI<o:p></o:p></p>
<p class="MsoPlainText">> - Using request parameters contained in Request Object MTI<o:p></o:p></p>
<p class="MsoPlainText">> - Supporting “preferred_locales” and “max_age” parameters MTI<o:p></o:p></p>
<p class="MsoPlainText">> - Supporting “claims” fields OPTIONAL<o:p></o:p></p>
<p class="MsoPlainText">> - If “claims” fields not supported, the claims returned would be determined by the OP<o:p></o:p></p>
<p class="MsoPlainText">> - It would be discoverable whether “claims” is supported by an OP<o:p></o:p></p>
<p class="MsoPlainText">> - Supporting “request_file” OPTIONAL<o:p></o:p></p>
<p class="MsoPlainText">> - It would be discoverable whether “request_file” is supported<o:p></o:p></p>
<p class="MsoPlainText">> - If “request_file” is not supported, the claims returned would be
<o:p></o:p></p>
<p class="MsoPlainText">> determined by the OP<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I’m not sure I understand your 2nd bullet point, “request parameters”.<o:p></o:p></p>
<p class="MsoPlainText">Maybe a pointer into section 2.1.1.1 would help?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">But here’s what I think you meant. A conforming implementation would be required to:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">- parse the request object<o:p></o:p></p>
<p class="MsoPlainText">- understand and comply with:<o:p></o:p></p>
<p class="MsoPlainText">-- request_object['userinfo']['preferred_locales']<o:p></o:p></p>
<p class="MsoPlainText">-- request_object['id_token']['sub']<o:p></o:p></p>
<p class="MsoPlainText">-- request_object['id_token']['auth_time']<o:p></o:p></p>
<p class="MsoPlainText">-- request_object['id_token']['max_age']<o:p></o:p></p>
<p class="MsoPlainText">-- request_object['id_token']['acr']<o:p></o:p></p>
<p class="MsoPlainText">- everything else can be ignored<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I’ll be honest; this seems like a bit of an uphill struggle. But before I take this to the guys, is my understanding of what you’re proposing correct?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-Tim<o:p></o:p></p>
</div>
</body>
</html>