<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
Hi all,<br>
<br>
<p>during the work on the Advanced Syntax for Claims spec, a
question came up in the eKYC working group. It seems that some
details of the constraints one can express using value/values in
OpenID Connect Core are not as clear as we thought.<br>
</p>
<p>The relevant bits of the spec: <a moz-do-not-send="true"
href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests"
class="moz-txt-link-freetext">https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests</a></p>
<p>Let's suppose that the OP has the following data about the
authenticated user:</p>
<ul>
<li>sub: 1337</li>
<li>given name: John</li>
<li>family name: Doe</li>
</ul>
<p>For clarity, I'll try to capture the bone of contention in two
questions. There is a potential for follow-ups, with other claim
names, essential, max_age etc., but let's focus on these examples
first:<br>
</p>
<p>------------------------------<br>
<br>
Q1: For this request, what should be the user claims in the ID
token?:<br>
<br>
<font face="monospace">claims={<br>
"id_token": {<br>
"given_name": {<br>
"value": <b>"Albert"</b><br>
},<br>
"family_name": null<br>
}<br>
}<br>
</font><br>
(A)<br>
<br>
<font face="monospace">{ "sub": "1337" }</font><br>
<br>
(All claims are omitted since the given name does not match. sub
must always be present in the ID Token, so it is not omitted.)<br>
<br>
(B)<br>
<br>
<font face="monospace">{<br>
"sub": "1337",<br>
"family_name": null<br>
}</font><br>
<br>
(given_name is omitted as it does not match the value constraint.
The other claims are not affected by the value constraint.)<br>
<br>
(C)</p>
<p>An error is sent back to the RP. While this is explictly
forbidden in case of unavailable "essential" claims, it is not
excluded for mismatches in value/value constraints.<br>
</p>
<p>(D)<br>
something else?<br>
<br>
------------------------------<br>
<br>
Q2: What about this request?<br>
<br>
<font face="monospace">claims={<br>
"id_token": {<br>
"sub": {<br>
"value": <b>"4224"</b><br>
}</font><font face="monospace"><font face="monospace">,<br>
"given_name": null,<br>
"family_name": null</font><br>
}<br>
}</font><br>
<br>
<br>
(A)<br>
<br>
<font face="monospace">{ "sub": "1337" }</font><br>
<br>
(Again, all claims are omitted since the sub does not match, but
in order to send back a valid response, sub must be present.)<br>
<br>
(B)</p>
<p>??? Not sure what other non-error solutions there could be.<br>
</p>
<p>(C)<br>
</p>
<p>An error is sent back to the RP. <br>
<br>
(D)<br>
<br>
something else?<br>
</p>
<p>------------------------------</p>
-Daniel<br>
<br>
</body>
</html>