<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks a lot Nat!</div>
<div><br>
</div>
<div>That makes sense.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Nat Sakimura <<a href="mailto:sakimura@gmail.com">sakimura@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, August 19, 2015 at 4:20 AM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>>, "<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] SCOPE not selectable<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">FYI, the reason Google is offering all or nothing is because if the claim is optional, the RP should not ask it per the principle of collection minimisation. If there is optional claims, then you are not adhering to it, and are can be violating
EU regulation / EU-US Safe Harbour. So, support of "optional" claims is more subtle than it looks. The optionality in this case would probably be like:
<div><br>
</div>
<div>Contact Method: provide us one of these [email, phone number, Line ID, ... , ]</div>
<div><br>
</div>
<div>My 2c. </div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">2015-08-18 7:08 GMT+09:00 Preibisch, Sascha H <span dir="ltr">
<<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Yes, thanks.</div>
<div><br>
</div>
<div>Sascha</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, August 17, 2015 at 3:05 PM
<div>
<div class="h5"><br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com" target="_blank">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] SCOPE not selectable<br>
</div>
</div>
</div>
<div>
<div class="h5">
<div><br>
</div>
<div>
<div style="word-wrap:break-word">All scopes and claims are considered voluntary/optional by default. If you use the claims request then you can mark a claim as essential.
<div><br>
</div>
<div>When defining new scopes, you can define them as you like, but that is outside of Connect.</div>
<div><br>
</div>
<div>John B.<br>
<div>
<blockquote type="cite">
<div>On Aug 17, 2015, at 6:51 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br>
<div>
<div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif">
<div>Thanks John!</div>
<div><br>
</div>
<div>I think in the end it really comes down to the app developer and the IdP for somehow let the user grant or deny certain SCOPEs/ permissions.</div>
<div><br>
</div>
<div>And yes, finding a general UI accepted by many parties will most likely not happen.</div>
<div><br>
</div>
<div>Thanks for the responses and I will take the section referenced below to write up a spec for our environment. We have more and more customers asking for the possibility to support that feature.</div>
<div><br>
</div>
<div>Sascha</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;border-width:1pt medium medium;border-style:solid none none;padding:3pt 0in 0in;border-top-color:rgb(181,196,223)">
<span style="font-weight:bold">From: </span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Monday, August 17, 2015 at 12:07 PM<br>
<span style="font-weight:bold">To: </span>Sascha Preibisch <<a href="mailto:sascha.preibisch@ca.com" target="_blank">sascha.preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-ab] SCOPE not selectable<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap:break-word">The permissions you are asking about in Android are not really Connect scopes or claims. They are permissions for the Google play store or OS to release information to the app, or for the app to perform actions.
<div><br>
</div>
<div>The good news is that in Android M it is no longer a all or nothing proposition, you can deselect permissions the app wants. However deselecting things will restrict app functionality as one would expect.</div>
<div><br>
</div>
<div>In OAuth there is no way to mark a scope as optional or required. </div>
<div><br>
</div>
<div>In Connect Sec 5.5.1 you can mark claims as essential to indicate to the AS that not returning those claims will cause the app not to function properly. </div>
<div><br>
</div>
<div><span style="font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; background-color: rgb(255, 255, 255);">"By requesting Claims as Essential Claims, the RP indicates to the End-User that releasing these Claims will ensure a smooth
authorization for the specific task requested by the End-User. Note that even if the Claims are not available because the End-User did not authorize their release or they are not present, the Authorization Server MUST NOT generate an error when Claims are
not returned, whether they are Essential or Voluntary, unless otherwise specified in the description of the specific claim.</span><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2">”</font></div>
<div>
<div><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2"><span style="background-color:rgb(255,255,255)"><br>
</span></font></div>
<div><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2"><span style="background-color:rgb(255,255,255)">Getting IdP to agree on UI is a hard thing. The Specification allows any scope or claim to be declined by the user. Making IdP put it in
the UI is something much harder. </span></font></div>
<div><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2"><span style="background-color:rgb(255,255,255)"><br>
</span></font></div>
<div><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2"><span style="background-color:rgb(255,255,255)">John B.</span></font></div>
<div><font face="verdana,charcoal,helvetica,arial,sans-serif" size="2"><span style="background-color:rgb(255,255,255)"><br>
</span></font></div>
<div>
<blockquote type="cite">
<div>On Aug 17, 2015, at 1:34 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br>
<div>
<div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif">
<div>Hi!</div>
<span>
<div style="word-wrap:break-word;font-size:14px;font-family:Calibri,sans-serif">
<div><br>
</div>
<div>It may be an old topic but on the weekend I got a new Android phone and I attempted to install the LinkedIn and Twitter apps. Both apps requested about 10 permissions. Which I denied and therefore not installed.</div>
<div><br>
</div>
<div>I may be the only one who is annoyed by that but what is the reason why there is no effort in creating “optional” permissions? In the earlier development phase of OpenID Connect I joined a working group call and showed an example of an authorization page
that required SCOPE “openid” but others were de-selectable by the resource owner. The others on that call did not appreciate that idea.</div>
<div><br>
</div>
<div>At IIW in March/ April 2014 Justin also mentioned the problem (what to do if requested SCOPE=LIVE KILL) but I do not see anyone addressing that or trying to change it.</div>
<div><br>
</div>
<div>Thanks for any thoughts on that,</div>
<div>Sascha</div>
</div>
</span></div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span></div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</span></div>
<br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature">Nat Sakimura (=nat)
<div>Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>