<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:330721483;
mso-list-template-ids:-28558896;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">The “value” constraint only affects the claim in which it occurs. Therefore, the claims returned in the first example (Q1) would be:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">{<o:p></o:p></p>
<p class="MsoNormal"> “sub”: “1337”,<o:p></o:p></p>
<p class="MsoNormal"> “family_name”: “Doe”,<o:p></o:p></p>
<p class="MsoNormal"> (plus all the other required ID Token Claims, such as “iss”, “aud”, “exp”, etc.)<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It is never an error condition for requested claims to not be available. They just aren’t returned.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the second example (Q2), the set returned would be:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">{<o:p></o:p></p>
<p class="MsoNormal"> “sub”: “1337”,<o:p></o:p></p>
<p class="MsoNormal"> “given_name”: “John”,<o:p></o:p></p>
<p class="MsoNormal"> “family_name”: “Doe”,<o:p></o:p></p>
<p class="MsoNormal"> (plus all the other required ID Token Claims, such as “iss”, “aud”, “exp”, etc.)<o:p></o:p></p>
<p class="MsoNormal">}<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While the “sub” value doesn’t match the requested value, a “sub” value is required in the ID Token, therefore, “sub” is returned anyway.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net>
<b>On Behalf Of </b>Daniel Fett via Openid-specs-ab<br>
<b>Sent:</b> Wednesday, April 13, 2022 9:14 AM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Cc:</b> Daniel Fett <fett@danielfett.de><br>
<b>Subject:</b> [Openid-specs-ab] A "simple" question regarding value/values constraints in OpenID Connect Core<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi all,<o:p></o:p></p>
<p>during the work on the Advanced Syntax for Claims spec, a question came up in the eKYC working group. It seems that some details of the constraints one can express using value/values in OpenID Connect Core are not as clear as we thought.<o:p></o:p></p>
<p>The relevant bits of the spec: <a href="https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests">
https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests</a><o:p></o:p></p>
<p>Let's suppose that the OP has the following data about the authenticated user:<o:p></o:p></p>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
sub: 1337<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
given name: John<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
family name: Doe<o:p></o:p></li></ul>
<p>For clarity, I'll try to capture the bone of contention in two questions. There is a potential for follow-ups, with other claim names, essential, max_age etc., but let's focus on these examples first:<o:p></o:p></p>
<p>------------------------------<br>
<br>
Q1: For this request, what should be the user claims in the ID token?:<br>
<br>
<span style="font-family:"Courier New"">claims={<br>
"id_token": {<br>
"given_name": {<br>
"value": <b>"Albert"</b><br>
},<br>
"family_name": null<br>
}<br>
}<br>
</span><br>
(A)<br>
<br>
<span style="font-family:"Courier New"">{ "sub": "1337" }</span><br>
<br>
(All claims are omitted since the given name does not match. sub must always be present in the ID Token, so it is not omitted.)<br>
<br>
(B)<br>
<br>
<span style="font-family:"Courier New"">{<br>
"sub": "1337",<br>
"family_name": null<br>
}</span><br>
<br>
(given_name is omitted as it does not match the value constraint. The other claims are not affected by the value constraint.)<br>
<br>
(C)<o:p></o:p></p>
<p>An error is sent back to the RP. While this is explictly forbidden in case of unavailable "essential" claims, it is not excluded for mismatches in value/value constraints.<o:p></o:p></p>
<p>(D)<br>
something else?<br>
<br>
------------------------------<br>
<br>
Q2: What about this request?<br>
<br>
<span style="font-family:"Courier New"">claims={<br>
"id_token": {<br>
"sub": {<br>
"value": <b>"4224"</b><br>
},<br>
"given_name": null,<br>
"family_name": null<br>
}<br>
}</span><br>
<br>
<br>
(A)<br>
<br>
<span style="font-family:"Courier New"">{ "sub": "1337" }</span><br>
<br>
(Again, all claims are omitted since the sub does not match, but in order to send back a valid response, sub must be present.)<br>
<br>
(B)<o:p></o:p></p>
<p>??? Not sure what other non-error solutions there could be.<o:p></o:p></p>
<p>(C)<o:p></o:p></p>
<p>An error is sent back to the RP. <br>
<br>
(D)<br>
<br>
something else?<o:p></o:p></p>
<p>------------------------------<o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">-Daniel<o:p></o:p></p>
</div>
</body>
</html>