Which is not the case that it may sometime change the hand. The name bearer suggests otherwise as well. Bearer is whoever has it. <div><br></div><div>From Oxford Dictionary: </div><div><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><span class="iteration" style="margin:0px 3px 0px 0px;padding:0px;border:none;font-weight:bold;color:rgb(51,51,51);font-family:Georgia,Palatino,'Palatino Linotype',Times,'Times New Roman',serif;font-size:12px;line-height:20px;text-align:left;background-color:rgb(255,255,255)">1</span><span class="definition" style="margin:0px;padding:0px;border:none;color:rgb(51,51,51);font-family:Georgia,Palatino,'Palatino Linotype',Times,'Times New Roman',serif;font-size:12px;line-height:20px;text-align:left;background-color:rgb(255,255,255)">a person or thing that carries or holds something:</span></div>
<div><div style="text-align:left"><span class="iteration" style="margin:0px 3px 0px 0px;padding:0px;border:none;font-weight:bold;color:rgb(51,51,51);font-family:Georgia,Palatino,'Palatino Linotype',Times,'Times New Roman',serif;font-size:12px;line-height:20px;background-color:rgb(255,255,255)">2</span><span style="background-color:rgb(255,255,255);color:rgb(51,51,51);font-family:Georgia,Palatino,'Palatino Linotype',Times,'Times New Roman',serif;font-size:12px;line-height:20px">a person who presents a cheque or other order to pay money:</span></div>
</div></blockquote><div><div><br></div><div>And here is a description of "bearer bond" from wikipedia: </div><div><br></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">A </span><b style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">bearer bond</b><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"> is a debt security issued by a business entity, such as a corporation, or by a government. It differs from the more common types of investment securities in that it is unregistered – no records are kept of the owner, or the transactions involving ownership. Whoever physically holds the paper on which the bond is issued owns the </span><a href="http://en.wikipedia.org/wiki/Financial_instrument" title="Financial instrument" style="text-decoration:none;color:rgb(11,0,128);background-image:none;background-color:rgb(255,255,255);font-family:sans-serif;font-size:13px;line-height:19px">instrument</a><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)">. This is useful for </span><a href="http://en.wikipedia.org/wiki/Investor" title="Investor" style="text-decoration:none;color:rgb(11,0,128);background-image:none;background-color:rgb(255,255,255);font-family:sans-serif;font-size:13px;line-height:19px">investors</a><span style="font-family:sans-serif;font-size:13px;line-height:19px;background-color:rgb(255,255,255)"> who wish to retain anonymity. Recovery of the value of a bearer bond in the event of its loss, theft, or destruction is usually impossible. </span></div>
</blockquote><div><div><br></div><div>At the same time, bearer is more privacy preserving in some sense. In a "registered token", i.e., token with the "azp", it is impossible to hide who is presenting it. </div>
<div><br></div><div>Nat<br><br><div class="gmail_quote">2013/3/29 Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I think I disagree with this statement. I had thought that without an “azp” claim, there is exactly one authorized presenter – the client that requested the
token.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">All of this discussion does point out that “azp” truly is underspecified – which was Brian’s primary observation. Otherwise we wouldn’t have experts who wrote
the specs with different views on what the claim means.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Nat Sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, March 28, 2013 4:26 PM<br>
<b>To:</b> Tim Bray<br>
<b>Cc:</b> Mike Jones; openid-specs-ab</span></p><div><div class="h5"><br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect and Identity Delegation<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">+1 ID Token without azp is equivalent to say, "azp":"*". That's what we call as bearer. In essence, azp is scoping the "from" and aud is scoping the "to". <u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">As to the text itself is concerned, there has been a request from Breno on the text, however, and we should take that into account as well. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Nat<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2013/3/29 Tim Bray <<a href="mailto:tbray@textuality.com" target="_blank">tbray@textuality.com</a>><u></u><u></u></p>
<div>
<p class="MsoNormal">I agree with Mike’s characterization. Why not include that exact sentence in the spec?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">On Thu, Mar 28, 2013 at 11:06 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>> wrote:<u></u><u></u></p>
</div>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">An audience is a party that the token can be legally presented to. The authorized presenter (azp)
is a party that can legally present the token to those audiences.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Brian Campbell<br>
<b>Sent:</b> Thursday, March 28, 2013 11:00 AM<br>
<b>To:</b> Matias Woloski<br>
<b>Cc:</b> openid-specs-ab<br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect and Identity Delegation</span><u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Mar 28, 2013 at 11:55 AM, Matias Woloski <<a href="mailto:matiasw@gmail.com" target="_blank">matiasw@gmail.com</a>> wrote:<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<ul type="disc">
<li class="MsoNormal">
What is the difference between having multiple audiences vs using azp?<u></u><u></u></li></ul>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">FWIW, I've long had the same question. Which is mentioned, among others about azp, in
<a href="https://bitbucket.org/openid/connect/issue/830/what-is-azp-really" target="_blank">
https://bitbucket.org/openid/connect/issue/830/what-is-azp-really</a> <u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div>
</div></div>