<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Helvetica, Arial, sans-serif">I've heard that the GSMA
Mobile Connect effort has this use case as part of the "extended
data attributes" use cases and I am curious how it's going to get
solved. I completely agree with your assessment of what the spec
allows hence my question to the group:)<br>
<br>
Specific claims would be very tedious.<br>
<br>
I suppose the spec could be updated to allow operators instead of
just the "essential" keyword.<br>
<br>
"age" : {">": 12"}<br>
<br>
Though that implies a well thought out filter mechanism and loses
the ability to specify the claim as "essential".<br>
<br>
So short term I can easily make this a RP/OP specific feature, but
it seems like something more people are going to need.<br>
<br>
Thanks,<br>
George<br>
</font><br>
<div class="moz-cite-prefix">On 11/8/16 8:25 AM,
<a class="moz-txt-link-abbreviated" href="mailto:Axel.Nennker@telekom.de">Axel.Nennker@telekom.de</a> wrote:<br>
</div>
<blockquote
cite="mid:29675b4b1b264048a6b25bc67dfe00fb@HE101654.emea1.cds.t-internal.com"
type="cite">
<pre wrap="">I think that computations on claim values are not possible with the current spec.
You can only ask for proprietary claims and RP and OP would need to agree on this OOB.
Changing the example from <a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter">http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a>
{
"userinfo":
{
"given_name": {"essential": true},
"nickname": null,
"email": {"essential": true},
"email_verified": {"essential": true},
"picture": null,
<a class="moz-txt-link-rfc2396E" href="https://schemas.xmlsoap.org/ws/2005/05/identity/claims/over18">"https://schemas.xmlsoap.org/ws/2005/05/identity/claims/over18"</a>: {"essential": true} /* :-) */
},
"id_token":
{
"auth_time": {"essential": true},
"acr": {"values": ["urn:mace:incommon:iap:silver"] }
}
}
We had discussions in the OASIS IMI (RIP) where Microsoft proposed using uprove for exactly that kind of request.
<a class="moz-txt-link-freetext" href="https://wiki.oasis-open.org/imi/">https://wiki.oasis-open.org/imi/</a>
There was a proposed variant of WS-* making uprove possible that added one more roundtrip compared to ws-* that was needed in InfoCards.
In general you don't know what the RP is going to ask (age>18) or (age<14) so solving this with fixed attributes is tedious and market specific.
Are you going to provide text for this query language to add to <a class="moz-txt-link-freetext" href="http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter">http://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a> ?
Cheers
Axel
<a class="moz-txt-link-freetext" href="http://www.theregister.co.uk/2006/03/28/infocard_identity/">http://www.theregister.co.uk/2006/03/28/infocard_identity/</a>
<a class="moz-txt-link-freetext" href="http://self-issued.info/?m=200806">http://self-issued.info/?m=200806</a>
-----Original Message-----
From: Openid-specs-ab [<a class="moz-txt-link-freetext" href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>] On Behalf Of George Fletcher via Openid-specs-ab
Sent: Friday, November 04, 2016 8:32 PM
To: <a class="moz-txt-link-abbreviated" href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>
Subject: [Openid-specs-ab] How to use OIDC claims as an identity oracle
Hi,
As a relying party, I'd love to be able to ask the OpenID Provider whether the user authenticating is over a particular age. This could be used in may use cases. However, when I look at the spec, there is only a provided claim name of 'birthdate'. I don't really want the user's birth date, just an assertion that the user is over a particular age.
I don't see a way to do this via the OIDC claim mechanism. Any thoughts on how a RP may make such a request?
Thanks,
George
_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<br>
</body>
</html>