<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I don’t know of anyone providing a validated age at this point.<div class="">Most people are asking for age.</div><div class=""><br class=""></div><div class="">Even for MNO validated age is complicated because you have people who are using the phone on a family plan that are not the account holder. </div><div class="">It needs a bunch of backend account management work to create and validate attributes for someone other than the primary account holder,</div><div class="">and even that can be dodgy as lots of people have phones on there parents credit cards/ identity. </div><div class=""><br class=""></div><div class="">That may wind up being something that someone like a civil registry or Drivers licence would provide as a distributed or aggregated claim.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 8, 2016, at 12:53 PM, George Fletcher <<a href="mailto:gffletch@aol.com" class="">gffletch@aol.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta content="text/html; charset=windows-1252" http-equiv="Content-Type" class="">
<div bgcolor="#FFFFFF" text="#000000" class="">
<font face="Helvetica, Arial, sans-serif" class="">A new claim would be fine.
I am trying to be a "good" RP and only ask for what is needed :) I
do agree that with the operator mechanism, it's easy to find the
age so maybe what Marc suggested would be the easiest. A new claim
for age with an expected response of a integer. And maybe the
claim is just not returned if the OP doesn't have a value to
provide. This would also allow the user to not send their age via
the consent flow.<br class="">
<br class="">
How are other RP's dealing with this issue? Using the existing
'birthdate' claim?<br class="">
<br class="">
Thanks,<br class="">
George<br class="">
</font><br class="">
<div class="moz-cite-prefix">On 11/8/16 10:43 AM, John Bradley
wrote:<br class="">
</div>
<blockquote cite="mid:2199BE00-067B-43F6-8B6F-04579DF36486@ve7jtb.com" type="cite" class="">
<pre wrap="" class="">It would likely need to be a new claim to avoid stepping on existing semantics.
Claim request can be an object. The only elements that we have reserved are “essential” , “value” and “values” nothing stopes us from defining an operator for one or more claims.
The default operator is equals eg
"sub": {"value": "248289761001”}
We could have a new verified_age { “essential”: true , “value”: 18 , “op”: “ge” }
Return true or false.
With operators lt, le, eq , ge, gt or something like that.
That would let the RP specify what they need as an adult in there jurisdiction.
On the other hand if people are handing out verified birthdates anyway this may be a more work that it is worth.
Are people people more likely to consent to giving out are you over 18 vs birthdate.
The downside of letting people ask for a year is that they can ask multiple times to find the year, so perhaps you would make them register the value for there area to prevent that.
John B.
</pre>
<blockquote type="cite" class="">
<pre wrap="" class="">On Nov 8, 2016, at 10:55 AM, George Fletcher via Openid-specs-ab <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab@lists.openid.net"><openid-specs-ab@lists.openid.net></a> wrote:
I've heard that the GSMA Mobile Connect effort has this use case as part of the "extended data attributes" use cases and I am curious how it's going to get solved. I completely agree with your assessment of what the spec allows hence my question to the group:)
Specific claims would be very tedious.
I suppose the spec could be updated to allow operators instead of just the "essential" keyword.
"age" : {">": 12"}
Though that implies a well thought out filter mechanism and loses the ability to specify the claim as "essential".
So short term I can easily make this a RP/OP specific feature, but it seems like something more people are going to need.
Thanks,
George
On 11/8/16 8:25 AM, <a class="moz-txt-link-abbreviated" href="mailto:Axel.Nennker@telekom.de">Axel.Nennker@telekom.de</a> wrote:
</pre>
<blockquote type="cite" class="">
<pre wrap="" class="">I think that computations on claim values are not possible with the current spec.
You can only ask for proprietary claims and RP and OP would need to agree on this OOB.
Changing the example from
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter">http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a>
{
"userinfo":
{
"given_name": {"essential": true},
"nickname": null,
"email": {"essential": true},
"email_verified": {"essential": true},
"picture": null,
<a class="moz-txt-link-rfc2396E" href="https://schemas.xmlsoap.org/ws/2005/05/identity/claims/over18">"https://schemas.xmlsoap.org/ws/2005/05/identity/claims/over18"</a>
: {"essential": true} /* :-) */
},
"id_token":
{
"auth_time": {"essential": true},
"acr": {"values": ["urn:mace:incommon:iap:silver"] }
}
}
We had discussions in the OASIS IMI (RIP) where Microsoft proposed using uprove for exactly that kind of request.
<a class="moz-txt-link-freetext" href="https://wiki.oasis-open.org/imi/">https://wiki.oasis-open.org/imi/</a>
There was a proposed variant of WS-* making uprove possible that added one more roundtrip compared to ws-* that was needed in InfoCards.
In general you don't know what the RP is going to ask (age>18) or (age<14) so solving this with fixed attributes is tedious and market specific.
Are you going to provide text for this query language to add to
<a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter">http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a>
?
Cheers
Axel
<a class="moz-txt-link-freetext" href="http://www.theregister.co.uk/2006/03/28/infocard_identity/">http://www.theregister.co.uk/2006/03/28/infocard_identity/</a>
<a class="moz-txt-link-freetext" href="http://self-issued.info/?m=200806">http://self-issued.info/?m=200806</a>
-----Original Message-----
From: Openid-specs-ab [
<a class="moz-txt-link-freetext" href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>
] On Behalf Of George Fletcher via Openid-specs-ab
Sent: Friday, November 04, 2016 8:32 PM
To:
<a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: [Openid-specs-ab] How to use OIDC claims as an identity oracle
Hi,
As a relying party, I'd love to be able to ask the OpenID Provider whether the user authenticating is over a particular age. This could be used in may use cases. However, when I look at the spec, there is only a provided claim name of 'birthdate'. I don't really want the user's birth date, just an assertion that the user is over a particular age.
I don't see a way to do this via the OIDC claim mechanism. Any thoughts on how a RP may make such a request?
Thanks,
George
_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<pre wrap="" class="">_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<pre wrap="" class="">
</pre>
</blockquote>
<br class="">
</div>
</div></blockquote></div><br class=""></div></body></html>