<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Mike, <div class=""><br class=""></div><div class="">Speaking as editor the format you propose ONLY works if “sub” becomes a URI so that all event specs can use it. Otherwise, OIDC becomes a special case which really kills the point of this work. It also makes the specification much much more complex. Maybe it is just me, but a complex spec generally implies complex implementation too.</div><div class=""><br class=""></div><div class="">If you want sub at the top level, that would mean that the OIDC spec format would have to look like:</div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">{<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "iss": "<a href="https://event.example.com" style="color: purple;" class="">https://event.example.com</a>",<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "aud": "s6BhdRkqt3",<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <font color="#b51a00" class="">"sub": “<a href="https://token.example.com/248289761001" class="">https://token.example.com/248289761001</a>",</font><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "iat": 1458668180,<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "exp": 1458668580,<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "events": [<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "<a href="https://specs.openid.net/logout" style="color: purple;" class="">https://specs.openid.net/logout</a>"<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> ],<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> "sid": "08a5019c-17e1-4977-8f42-65a12843ea02"<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">}</div><div class=""><br class="webkit-block-placeholder"></div><div class="">Given that events are signed (or should be), <u class="">I will object strongly within the OIDF that the event issuer and the token issuer MUST be the same or that OIDF adopt a different format</u>. Yes having iss be the same is a nice security convenience, but it imposes the architecture restriction that it be the same server. At scale, delivery of events may become a problem for large scale providers if they are also delivering tokens to relying parties. The restriction isn’t really justified given the crypto alternative — which was the whole point of using JWT in the first place.</div><div class=""><br class=""></div><div class="">Per Justin’s comment, it seems elegant/trivial that a logout event simply has logout at the top level and an ID Token attached (though it might convey a lot of unneeded claims). IMO, the OIDC logout spec should only convey the ID Token JTI. It is going to be rare that you log out all devices for a user. To most users, it means clear SSO within this browser only! One can argue that clearing all devices/sessions is a different event entirely. It is an account reset or lock-out action.</div><div class=""><br class=""></div><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Aug 11, 2016, at 9:32 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" class="">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">See my previous message, John, which was a reply to Phil’s message that you also replied to, that contained a logout claims example. I’m not proposing to special-case the Connect Logout message in any way. The “iss” is the event issuer. The other claims in the message are those defined by the event to be included, just like those for any other event. Yes, the logout message doesn’t include a second issuer, a second subject, an ID Token as a claim, or anything else complicated like that, because those things aren’t needed for the logout use case.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">As I’d written previously, the ID Events spec should define the “events” claim, how to use an event name as a claim (when needed), and say that the event JWT must be signed by the issuer, and stop there. Trying to micro-manage claims usage within an event will only result in the ID Events spec being harder to use. If we’d tried to similarly micro-manage JWT claims usage, JWT would likely not have been the success that it is.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> -- Mike<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""><o:p class=""> </o:p></span></a></div><span class=""></span><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>John Bradley [<a href="mailto:ve7jtb@ve7jtb.com" class="">mailto:ve7jtb@ve7jtb.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, August 11, 2016 12:22 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" class="">Michael.Jones@microsoft.com</a>>; <a href="mailto:id-event@ietf.org" class="">id-event@ietf.org</a>; Marius Scurtescu <<a href="mailto:mscurtescu@google.com" class="">mscurtescu@google.com</a>>; <a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a> Ab <<a href="mailto:openid-specs-ab@lists.openid.net" class="">openid-specs-ab@lists.openid.net</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Id-event] Summarizing recent discussions on ID-Event token draft<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Not surprisingly a multipurpose message format will not be as optimized as a single purpose one.<o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Connect itself doesn’t really have a conflict around issuer the same entity sending the logout message is always the one that created the id_token that it refers to.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Using the same format as id_token with the same semantics to identify the thing to be terminated makes sense from a purely openID Connect point of view.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Oter messages that have different notions of subject and are issued by different parties than the one that controls the subject cause issues when you try and fit them into the same format as an ID_Token, I grant you that.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">It was mentioned that we need to differentiate between these events and id_tokens. Mostly we need to do that in cases where the token might be presented in the front channel.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">To do that se do have mandatory claims for nonce and c_hash or at_hash as well as the addition of events parameter to reduce confusion. Now I admit that some people may still get that wrong, and the removal of sub from the top level would remove any concern. However Mike has a point that adoption may be hurt if we change the semantics too much.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I don’t see backchannel single logout being used by many social login RP, it is a lot of work to maintain server side state. It is mostly an enterprise and large site sort of feature.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">That may or may not impact on if it is better to be simple and aligned with connect’s id token or more general purpose to fit with other enterprise to SaaS features like SCIM events.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I think the two directions lead to different formats. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The compromise of special casing Connect SLO and bodging the formats together is probably the worst option.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">John B.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Aug 11, 2016, at 11:59 AM, Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" style="color: purple; text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">How do you resolve conflicts on iss then? The top level has to be the issuer of the event as the issuer signs. <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">If one spec can use it all must be able to. I believe you previously objected to that saying sub must be as how id tokens define them. But that isnt unique and requires iss. Now we would have sub at the top with an event issuer at the top and a sub issuer in the extension. That seems incredibly complex not to mention awkward. <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">If we make sub a uri for all then it can work ass iss from id token would not be needed. But i can see many objecting to the change in format. <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><o:p class=""> </o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">Why not have a logout be an event with an id token attached for example?<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class="">Phil<o:p class=""></o:p></span></div></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class="">On Aug 11, 2016, at 8:03 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>> wrote:<o:p class=""></o:p></span></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; font-variant-caps: normal; orphans: auto; text-align: start; widows: auto; -webkit-text-stroke-width: 0px; word-spacing: 0px;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">The simple rule is that if the particular event calls for the “sub” claim to be at the top level, then it is. This is no different from any other claim that an event might place at the top level.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">The complexity arises if “sub” is unnecessarily special-cased. We shouldn’t do that, because it limits the applicability of the specification.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> -- Mike</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Phil Hunt (IDM) [<a href="mailto:phil.hunt@oracle.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mailto:phil.hunt@oracle.com</span></a>]<span class="apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Thursday, August 11, 2016 9:40 AM<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span>Marius Scurtescu <<a href="mailto:mscurtescu@google.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mscurtescu@google.com</span></a>>;<span class="apple-converted-space"> </span><a href="mailto:id-event@ietf.org" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">id-event@ietf.org</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>Re: [Id-event] Summarizing recent discussions on ID-Event token draft</span><o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I think using sub at the top level leads to complexity. Eg Can you provide a rule for when top level is used or not by an individual spec? IMO. Top level should always be used the same way by all implementers. <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Based on the calls at risc/connect, we discussed that it would be best to move all event specifics to the event object area. This way different events can have different event addressing (eg sub/iss, uri, jit/iss). When iss is needed to uniquely qualify a sub, it can be provided without conflicting with the issuer of the event. Similarly jti and iss can be used for a revoked token without conflicting with the event jti. <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I plan to post a new draft shortly that will give some examples based on feedback from the openid risc/connect discussions.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">We can always change again. <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class="">Phil<o:p class=""></o:p></div></div></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><br class="">On Aug 11, 2016, at 4:54 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>> wrote:<o:p class=""></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">No, I’m not saying that “sub” cannot appear at the top level. I’m saying that “sub” will only occur at the top level if the particular event defines that “sub” is used in that way for that event.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">There are probably use cases for multiple events per message but I doubt there are use cases for multiple *<b class="">unrelated</b>* events per message. By definition, related events that use top-level claims would need to use them in a compatible way. I don’t see that as being a problem.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">That being said, the predominant use case is likely to be a single event per JWT.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> -- Mike</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Marius Scurtescu [<a href="mailto:mscurtescu@google.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mailto:mscurtescu@google.com</span></a>]<span class="apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Tuesday, August 9, 2016 7:15 PM<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>Phil Hunt <<a href="mailto:phil.hunt@oracle.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">phil.hunt@oracle.com</span></a>><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>>;<span class="apple-converted-space"> </span><a href="mailto:id-event@ietf.org" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">id-event@ietf.org</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>Re: [Id-event] Summarizing recent discussions on ID-Event token draft</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Mike, are you suggesting that a sub claim can only show up at the event level and not at the top level:<o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">In particular, the only thing that the spec should say about the “sub” claim is that “Like all other claims other than ‘events’ and ‘iss’, whether the ‘sub’ claim is to be included with an event is entirely event-specific.<o:p class=""></o:p></div></div></blockquote><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">A top level sub and multiple events are incompatible IMO.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Do we have a compelling reason to support multiple events per message?<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br clear="all" class=""><o:p class=""></o:p></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Marius<o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Tue, Aug 9, 2016 at 12:39 PM, Phil Hunt <<a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">phil.hunt@oracle.com</span></a>> wrote:<o:p class=""></o:p></div></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I was referring to this in your email<o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">"<span style="font-size: 11.5pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Define that an event name can be used as a top-level claim”</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Is this different from the event uri?<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Phil<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">@independentid<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="http://www.independentid.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">www.independentid.com</span></a><o:p class=""></o:p></div></div></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">phil.hunt@oracle.com</span></a><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;"> <o:p class=""></o:p></p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Aug 9, 2016, at 12:12 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">I’m glad to hear that we agree on keeping it as simple and general-purpose as possible and that you agree with my write-up. I think we then have a good path forward.</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">I’m not sure what you mean by “</span>I’m not sure that we need a “name”. What is your intention there.<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">” The only place I used the word “name” was in my statement “Define that an event name can be used as a top-level claim”. What I was trying to get at is was that if “<a href="http://specs.openid.net/logout" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">http://specs.openid.net/logout</span></a>” is used as an event name, that it can also be used as a claim name in the JWT containing information about the event. (Maybe I’m not using the correct terminology, hence the unintended confusion<span class="m-6534435573639673786apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Wingdings; color: rgb(0, 32, 96);" class="">J</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">.)</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> Thanks again,</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> -- Mike</span><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="m_-6534435573639673786__MailEndCompose" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span></a><span class=""></span><o:p class=""></o:p></div></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="m-6534435573639673786apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Phil Hunt [<a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mailto:phil.hunt@oracle.com</span></a>]<span class="m-6534435573639673786apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="m-6534435573639673786apple-converted-space"> </span>Tuesday, August 9, 2016 12:07 PM<br class=""><b class="">To:</b><span class="m-6534435573639673786apple-converted-space"> </span>Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>><br class=""><b class="">Cc:</b><span class="m-6534435573639673786apple-converted-space"> </span><a href="mailto:id-event@ietf.org" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">id-event@ietf.org</span></a><br class=""><b class="">Subject:</b><span class="m-6534435573639673786apple-converted-space"> </span>Re: [Id-event] Summarizing recent discussions on ID-Event token draft</span><o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I didn’t cover this as I didn’t want to confuse people with too many things.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">But I think we agree on all of the below.<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I’m not sure that we need a “name”. What is your intention there.<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Phil<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">@independentid<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="http://www.independentid.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">www.independentid.com</span></a><o:p class=""></o:p></div></div></div></div></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">phil.hunt@oracle.com</span></a><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;"> <o:p class=""></o:p></p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Aug 9, 2016, at 11:54 AM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Michael.Jones@microsoft.com</span></a>> wrote:<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Thanks for writing this, Phil. Unfortunately, the summary below does not include my feedback, which at the essence, is to keep the ID Events data structure as simple and general-purpose as possible. (I strongly believe that JWT is the success it is because we made JWT as simple and general-purpose as possible, and we should follow this successful example and do the same here.)</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">I believe that the ID Events spec needs to include these things, and these things only:</span><o:p class=""></o:p></div></div></div></div><div style="margin-left: 0.5in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Symbol; color: rgb(0, 32, 96);" class="">·</span><span style="font-size: 7pt; color: rgb(0, 32, 96);" class=""> <span class="m-6534435573639673786apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Define of the “events” claim</span><o:p class=""></o:p></div></div></div></div><div style="margin-left: 0.5in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Symbol; color: rgb(0, 32, 96);" class="">·</span><span style="font-size: 7pt; color: rgb(0, 32, 96);" class=""> <span class="m-6534435573639673786apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Define that an event name can be used as a top-level claim</span><o:p class=""></o:p></div></div></div></div><div style="margin-left: 0.5in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Symbol; color: rgb(0, 32, 96);" class="">·</span><span style="font-size: 7pt; color: rgb(0, 32, 96);" class=""> <span class="m-6534435573639673786apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Require that “iss” be included and that the JWT be signed by the issuer</span><o:p class=""></o:p></div></div></div></div><div style="margin-left: 0.5in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Symbol; color: rgb(0, 32, 96);" class="">·</span><span style="font-size: 7pt; color: rgb(0, 32, 96);" class=""> <span class="m-6534435573639673786apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">Include a statement along the lines of “The claims to be included with any particular event are to be defined by the event”</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">And I’d stop there.</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">It should be entirely up to applications to say what claims are included with events they define and what their format and meanings are. Then the ID Events spec will be as general-purpose as possible, with it being natural for it to be used in essentially all JSON Event contexts.</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class="">As soon as we start putting restrictions on the use of particular claims by events, we’re making the ID Events spec less general-purpose and less natural to use. In particular, the only thing that the spec should say about the “sub” claim is that “Like all other claims other than ‘events’ and ‘iss’, whether the ‘sub’ claim is to be included with an event is entirely event-specific. The claims to be included with any particular event are explicitly outside the scope of this specification.”</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> -- Mike</span><o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 32, 96);" class=""> </span><o:p class=""></o:p></div></div></div></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="m-6534435573639673786apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Id-event [<a href="mailto:id-event-bounces@ietf.org" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">mailto:id-event-bounces@ietf.org</span></a>]<span class="m-6534435573639673786apple-converted-space"> </span><b class="">On Behalf Of<span class="m-6534435573639673786apple-converted-space"> </span></b>Phil Hunt<br class=""><b class="">Sent:</b><span class="m-6534435573639673786apple-converted-space"> </span>Tuesday, August 9, 2016 10:19 AM<br class=""><b class="">To:</b><span class="m-6534435573639673786apple-converted-space"> </span><a href="mailto:id-event@ietf.org" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">id-event@ietf.org</span></a><br class=""><b class="">Subject:</b><span class="m-6534435573639673786apple-converted-space"> </span>[Id-event] Summarizing recent discussions on ID-Event token draft</span><o:p class=""></o:p></div></div></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I thought I would update the list on some discussions that have been happening over in the OpenID Connect and RISC working groups conference calls.<o:p class=""></o:p></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">These discussions have been about the core spec and the role of “top-level” attributes vs. event “extension” attributes. <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">See:<span class="m-6534435573639673786apple-converted-space"> </span><a href="https://tools.ietf.org/html/draft-hunt-idevent-token-01" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://tools.ietf.org/html/draft-hunt-idevent-token-01</span></a><o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">In particular should “sub” be used in the top level to “point” to the subject (in the broader english sense) of the event, or should it be constrained to the SAML/ID Token definition which is the authenticated user. <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Taken in the narrower definition, it is important to observe that in an ID Token, “sub” and “iss” go together. The issuer provides the context for the authenticated subject identifier. The problem with events, is that it might not be the AS (or OP) which is issuing the event. <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">To summarize a fair amount of discussion, the feeling seems to be the following:<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">* The Event Token top level attributes should be fairly limited and not include the sub attribute. <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">* For events that are about a user, the relevant event specification may include a “sub” attribute within the event’s sub-object and not in the top-level. Further that sub-object can also include the issuer of the user. <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">* The top-level “iss” shall mean the issuer of the event where the state change occurred.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">* “sub” should not be present in the top level structure. Also, “events” must also be present.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Here would be a new example logout:<o:p class=""></o:p></div></div></div></div></div><div class=""><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">{<o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""> <— top level is about the event itself -><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""> <span style="color: rgb(94, 48, 235);" class="">"iss": "<a href="https://server.example.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://server.example.com</span></a>",</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "aud": "s6BhdRkqt3",</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "iat": 1458668180,</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "exp": 1458668580,</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "events": [</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> "<a href="https://specs.openid.net/logout" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://specs.openid.net/logout</span></a>"</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(94, 48, 235);" class=""> ],</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""> <span style="color: rgb(230, 59, 122);" class=""> "<a href="https://specs.openid.net/logout" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://specs.openid.net/logout</span></a>": {</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(230, 59, 122);" class=""> <- This level is defined entirely by the event URI-></span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(230, 59, 122);" class=""> "iss": "<a href="https://oidc.example.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://oidc.example.com</span></a>",</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="color: rgb(230, 59, 122);" class=""> “jti": "08a5019c-17e1-4977-8f42-65a12843ea02”,</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="font-size: 12pt; color: rgb(230, 59, 122);" class=""> "sub": "248289761001”,</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="font-size: 12pt; color: rgb(230, 59, 122);" class=""> “exp”: <ID token expiry></span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="font-size: 12pt; color: rgb(230, 59, 122);" class=""> }</span><o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><span style="font-size: 12pt;" class="">}</span><o:p class=""></o:p></pre><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">In the above example note that the “event” object can have its own iss and subject (sub or jti) that have meaning within the context of an OpenID OP provider. The issuer of the event can be different (the top-level) and represents the entity that signs the event (if it is signed).<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The top-level attributes identify an individual event and are used to validate the event (signing etc). Where as the nested object contains all of the data about the event and is defined by the profiling specification (e.g. a possible OpenID Logout Event spec). In this case, in OpenID, logging out usually translates into revoking an ID Token. Thus the “jti” for the ID token (08a5019c...843ea02) is included in the Logout object.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Side note. Regarding “logout”, it might be useful to include the expiry of the ID Token in case the subscriber has not yet received an ID Token. This would let the subscriber know how long it needs to keep the revocation information for. IOW…after the the ID Token is expired, the subscriber would no longer need to track the revocation state.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">It is also good to observe that the “aud” at the top level describes the subscriber of the event. This may also be different then the original audience of the ID Token.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">So to conclude. By making top-level attributes strictly about the events own validation, and nested objects about the event, we avoid collisions in definitions such as the issuer of the event, vs. the original issuer of a security assertion.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I hope I’ve gotten everyone’s feedback correct here. Lets continue to discuss. I will revise the draft to follow the groups thinking here.<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Phil<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">@independentid<o:p class=""></o:p></div></div></div></div></div><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="http://www.independentid.com/" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">www.independentid.com</span></a><o:p class=""></o:p></div></div></div></div></div></div></div></div><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">phil.hunt@oracle.com</span></a><o:p class=""></o:p></div></div></div></div></div></div></div></div></div></div></blockquote></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">_______________________________________________<br class="">Id-event mailing list<br class=""></span><a href="mailto:Id-event@ietf.org" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">Id-event@ietf.org</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""></span><a href="https://www.ietf.org/mailman/listinfo/id-event" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif; color: purple;" class="">https://www.ietf.org/mailman/listinfo/id-event</span></a><o:p class=""></o:p></div></div></div></blockquote></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><br class="">_______________________________________________<br class="">Id-event mailing list<br class=""><a href="mailto:Id-event@ietf.org" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Id-event@ietf.org</span></a><br class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://www.ietf.org/mailman/listinfo/id-event</span></a><o:p class=""></o:p></p></blockquote></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">_______________________________________________<br class="">Id-event mailing list<br class=""><a href="mailto:Id-event@ietf.org" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Id-event@ietf.org</span></a><br class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">https://www.ietf.org/mailman/listinfo/id-event</span></a><o:p class=""></o:p></div></div></div></blockquote></div></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">_______________________________________________<br class="">Id-event mailing list<br class=""><a href="mailto:Id-event@ietf.org" style="color: purple; text-decoration: underline;" class="">Id-event@ietf.org</a><br class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" style="color: purple; text-decoration: underline;" class="">https://www.ietf.org/mailman/listinfo/id-event</a></span><o:p class=""></o:p></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Id-event mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="mailto:Id-event@ietf.org" class="">Id-event@ietf.org</a></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" class="">https://www.ietf.org/mailman/listinfo/id-event</a></span></div></blockquote></div><br class=""></div></body></html>