<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hi,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I had a conversation with Recruit who is currently using SIOP flow to authenticate users across 10+ apps owned by
<a href="https://www.recruit.co.jp/en/" title="https://www.recruit.co.jp/en/">Recruit</a>, a large Japanese HR tech company. It is a closed ecosystem with
<a href="https://paymentnavi.com/paymentnews/96205.html?fbclid=IwAR3Dq2mLZHM5UbvrimkHbIjFscIhMKlclMPJlpH5i3bmRu8UfxKvgOvSXW4" title="https://paymentnavi.com/paymentnews/96205.html?fbclid=IwAR3Dq2mLZHM5UbvrimkHbIjFscIhMKlclMPJlpH5i3bmRu8UfxKvgOvSXW4">
90 million total users</a> (number of active users are not public, but should be much less). </div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Please find detailed notes below</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<ul>
<li>Value / why chose SIOP</li><ul>
<li>for app A and B <span style="font-family:Calibri,Arial,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline!important">offered by Recruit, </span>users using app A do not have to enter ID/Pass when logging in to app B <span style="font-family:Calibri,Arial,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline!important">on
the same device (to reduce churn rate)</span></li></ul>
<li>Flow (Image from <a href="https://speakerdeck.com/rtechkouhou/openid-connect-self-issued-idpwoying-yong-sitasingle-sign-onfalseshi-zhuang?slide=29" title="https://speakerdeck.com/rtechkouhou/openid-connect-self-issued-idpwoying-yong-sitasingle-sign-onfalseshi-zhuang?slide=29">
the deck</a> <span style="font-family:Calibri,Arial,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline!important">attached<span> </span></span>)</li><ol>
<li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">User registers public key (thimbprint) with Recruit's authorization server (need to s</span><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">ign-in
using Recruit ID on the device)</span><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">. </span></li><li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">Authorization server sends a nonce to SIOP (new nonce every time)</span></li><li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">SIOP sends back signed id-token and nonce</span></li><li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">User signs-in to the app (this step will be omitted after the second log-in if AS can validate id_token using public key's thumbprint and nonce)<br>
</span></li></ol>
<li>Highlights</li><ul>
<li>there is a variation of the above flow that uses biometrics (uses acr and amr claims)</li><li>not using Claims parameter</li><li>key rotation</li><ul>
<li>for internal use-cases (apps managed by the same company, Recruit), they would like to continue using JWK's thumbprint in sub field. If thumbprint value changes everytime, they cannot step 4 in the above flow cannot be omitted + they would not be able to
tie several apps to one user</li><li>for inter-company use-cases, they see the benefit of introducing key rotation</li><li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">Key rotation would be beneficial for recovery when device is lost</span><br>
</li><li><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt">adding URN in sub field should not require a lot of changes in current implementation..<br>
</span></li></ul>
</ul>
</ul>
<div>Some of the issues in SIOP Laundry List were not relevant to Recruit's implementation which is closed to Recruit ecosystem. (Claims binding, SIOP discovery, etc.)</div>
<div>Regarding adding the level of indirection to 'sub' field, they were welcoming the change, but wanted to see current 'sub' = thumbprint of the key implementation remaining valid.</div>
<div><span style="color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt"><br>
</span></div>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Best,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Kristina</div>
</body>
</html>