<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Agreed with your assessment. </div><div>Token requesting party in case 3 may kick in when audit tracing becomes important. Until now, we have pretty much been concerned with application use cases, but it probably is a good time to start looking at audit tracing and other use cases as well. </div>
<div><br>=nat via iPhone</div><div><br>Apr 11, 2013 23:56$B!"(BGeorge Fletcher <<a href="mailto:gffletch@aol.com">gffletch@aol.com</a>> $B$N%a%C%;!<%8(B:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
<font face="Helvetica, Arial, sans-serif">Hi,<br>
<br>
As I was working on some possible text for azp, I realized I have
some questions around aud as well. I figure there has to be some
general consensus about when and how to use them so figured I'd
ask on the list rather than filing a ticket.<br>
<br>
I can see a couple of use cases for these fields in the id_token
and the values they contain seem like they can change depending on
the context.<br>
<br>
1. id_token used only by the client and never presented back to
the AS or related endpoint<br>
aud = client_id of the requesting client<br>
azp = not really needed at all<br>
<br>
2. id_token used by the client but also presented to the AS for
session management or bootstrapping endpoints<br>
aud = ??? (seems like it should be the identifier of the AS)<br>
azp = client_id of the requesting client<br>
<br>
3. id_token requested by a client and then presented by another
client to some endpoint<br>
aud = identifier representing the endpoint that will receive
the id_token<br>
azp = identifier of the client presenting the id_token<br>
<br>
??? = no mention of the actual requesting client (is this
needed?)<br>
<br>
Other use cases?<br>
<br>
For me, I'd prefer to collapse use cases 1 and 2 and require azp
to be the client_id of the requesting client and aud be the
identifier of the AS or resource endpoint.<br>
<br>
Thanks,<br>
George<br>
</font>
<div class="moz-signature">-- <br>
<a href="http://connect.me/gffletch" title="View full card on
Connect.Me"><XeC></a></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br>
<span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></body></html>