<div dir="ltr">Realistically, it has to be claim names. In some cases, spec-defined names have spec-constrained values and it's not OK to ignore insane values of email_verified or some such. -T<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Fri, May 31, 2013 at 11:37 PM, Nat Sakimura <span dir="ltr"><<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Actually, Messages say re: JWT, "<span style="font-family:verdana,charcoal,helvetica,arial,sans-serif">Any Claims used that are not understood MUST be ignored."</span><div>Now, the question is, by this statement, it is talking about the (1) claim names or (2) claim values, or (3) both. </div>
<div>We may want to tighten it up as well. <br></div><div><br></div><div>Also, when we speak of "understand", it again is a bit vague. The text I added was an attempt to write "understand" in this context in a more precise way. </div>
<div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">2013/6/1 Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I disagree with the MUSTs. We already have language in place saying that if claims aren’t understood, they should be ignored, so there’s no actual problem.
(Were there a problem, it would apply to “acr” as well.)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I could see going as far as saying, in both “acr” and “amr” that “The definition of particular values to be used in the
</span><span style="font-size:11.0pt;font-family:"Courier New";color:#1f497d">acr/amr</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> Claim is beyond the scope of this specification. Parties using this claim will need
to agree on the meanings of the values used for it to be useful to them.”<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Nat Sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>]
<br>
<b>Sent:</b> Friday, May 31, 2013 6:06 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> Torsten Lodderstedt; OpenId Connect List</span></p><div><div><br>
<b>Subject:</b> Re: [Openid-specs-ab] amr vs acr<u></u><u></u></div></div><p></p><div><div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Ah, that's the call in the morning of the JICS that you did in the 11th floor of NII. <u></u><u></u></p>
<div>
<p class="MsoNormal">I came in late, sitting at a different table that hearing to the call was a bit hard but did not mind as I was very much distracted by various things to be dealt with JICS. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I remember talking about changing 1,2,3,4 as it became non-compliant to the RFC, as well as arguing against conflating authentication method with the authentication class, on the basis that authentication method by itself is useless and
harmful, as in the previous mail. I mistakingly thought that I have killed the idea of amr, which apparently was not. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Unfortunately, the discussion is not recorded in <a href="http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20130304/003231.html" target="_blank">http://lists.openid.net/pipermail/openid-specs-ab/Week-of-Mon-20130304/003231.html</a> . <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Probably, we should add some warning text to amr then. At the end of the definition of arm, how about adding the following? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">When using amr, the RP and OP MUST define the common context including the meaning, security characteristics, and the compliance requirement for using it and the RP MUST be able to evaluate the values according to the defined context. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">That would mitigate my worries. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2013/6/1 Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This was one of the two open issues discussed on the 4-Mar-13 working group call. You were on that
call, according to the minutes. We had a fairly extensive discussion about the meaning of “acr” and the right way to return information about authentication methods used. Originally the request was to allow multi-valued “acr” values. There was a use case
where an implementation wanted to communicate the actual methods used such as “password”, “OTP”, “code in text message”, etc. and I’d originally advocated for letting “acr” be multi-valued, just like PAPE did. John, Tony, and I think you convinced us that
that conflating classes with methods would create more problems than it would solve and that it was better to define an optional claim for returning an array of methods used, when needed.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">On that call we also deleted the LoA values “1”, “2”, “3”, and “4” since as part of that discussion,
it came up that they are prohibited by RFC 6711. Instead, we replaced the example values used with real values from InCommon - urn:mace:incommon:iap:bronze and urn:mace:incommon:iap:silver.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I don’t think that we should require “acr” when “amr” is used, because there may not be a class,
even though there are methods. It depends upon the business context in which the parties are communicating. Like “acr”, “amr” is only useful when the values are understood by both parties. Nonetheless, it’s better to have a standard claim for these methods
than to have everyone make up a different one. This kind of information is used in practice, in some contexts.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Nat Sakimura<br>
<b>Sent:</b> Friday, May 31, 2013 4:53 PM<br>
<b>To:</b> Torsten Lodderstedt<br>
<b>Cc:</b> OpenId Connect List<br>
<b>Subject:</b> Re: [Openid-specs-ab] amr vs acr</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">s/<span style="font-size:10.5pt;font-family:"Arial","sans-serif""> where acr gives more context to the values of acr. / where acr gives more context to the values of amr. /</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"> <u></u><u></u></p>
<div>
<p class="MsoNormal">2013/6/1 Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">I suppose you mean amr, not acm. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal">I actually was not aware of amr till now. It seems it was a fairly quick decision made between March 4 and 6. <u></u><u></u></p>
<div>
<p class="MsoNormal">See <a href="https://bitbucket.org/openid/connect/issue/789/make-acr-claim-values-be-arrays-of-acr" target="_blank">https://bitbucket.org/openid/connect/issue/789/make-acr-claim-values-be-arrays-of-acr</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">At the time, I was so busy managing JICS 2013, so it went unnoticed for me. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I also searched through the list archive, but I cannot find the topic in it. There is no record of the decision on the call notes either. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Mike, could you point us to the record how the WG decision was reached? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Apparently, amr is the list of authentication methods, while acr is the indicator of the identity proofing and authentication quality. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">i.e., amr is just the list of such things like "password", "otp", etc. while acr is "InCommons Silver", "ISO29115 LoA 3", etc. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Personally, I do not see much value in amr since it does not indicate any quality information. It may even be harmful when used without context in the sense that it may create sense
of false security to the relying parties. For example, "otp" by itself does not mean it is secure. An OTP system with badly managed seed will generate a predictable sequence of "one time passwords", which is not secure at all. It would only be meaningful when
there is an assurance that the system is properly managed. In this respect, amr may be meaningful as an auxiliary information only when it is used with acr, where acr gives more context to the values of acr. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I might want to require acr if amr is used, or drop amr, but that is only my personal opinion. <u></u><u></u></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"> <u></u><u></u></p>
<div>
<p class="MsoNormal">2013/6/1 Torsten Lodderstedt <<a href="mailto:torsten@lodderstedt.net" target="_blank">torsten@lodderstedt.net</a>><u></u><u></u></p>
<p class="MsoNormal">Hi,<br>
<br>
could someone please describe me the difference between the id token members acr and acm? From my understanding, they are just the same. I'm also interested to learn why the authorization request allows to specify multiple acrs but does not support to specify
any authentication method (via acm). Additionally, why is there no way to indicate more than one acr in the id token?<br>
<br>
Thanks in advance,<br>
Torsten.<br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="color:#888888">--
<br>
Nat Sakimura (=nat)</span><u></u><u></u></p>
<div>
<p class="MsoNormal"><span style="color:#888888">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</span><u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal">--
<br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div>
</div>
</div></div><br>_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br></blockquote></div><br></div>