<div dir="ltr">Darin - If this doesn't make it through to the list, could you repost?<div><br></div><div> As was mentioned, the JWT that the identity provider sent to the application provider for the registration request in 7.2.3.1 contains the IDP domain and the tenant ID of the application provider. The most straightforward option would be to re-send the initial JWT to the finalization endpoint. Alternatively the IDP could generate a cut-down JWT with just the IDP domain and the tenant id.<br></div><div><div><br></div><div>With regards to returning failure to the finalize URL, I had been of the opinion that since by that point the entire configuration had been agreed on by the IDP and Application provider, that the onus would be on the IDP to fix things and roll forward if it had a problem, calling /finalize when it was able to do so. If the IDP returned failure at this point it would seem to me to indicate some sort of serious internal failure. If so I would imagine the logical course would be to declare the entire federation in error and restart the entire handshake over.</div><div><br></div><div>Wes Dunnington</div><div><br></div><div>Wes Dunnington</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 18, 2019 at 2:05 PM Brian Rose via Openid-specs-fastfed <<a href="mailto:openid-specs-fastfed@lists.openid.net">openid-specs-fastfed@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-3757908984673565870WordSection1">
<p class="MsoNormal">Yes, that would be great. Would there be any other information returned in the payload? Or is it going to be just enough for the AP finalize call to know the issuer and tenant? At an absolute minimum, “iss” and “sub” are what I would
need. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Also, related to the payload, section 7.2.4 states “<span style="font-size:10pt;font-family:Verdana,sans-serif;color:black">the Identity Provider MUST invoke this endpoint after
<b>successfully</b> processing…”. Should </span>the finalize endpoint ALWAYS get called, even if there is an error somewhere in the handshake? If so, it might be nice for it to have some error information so the AP knows that the IdP will no longer be attempting.
Or, after 48 hours (or whatever the retry span is), that it was ultimately unsuccessful and what the corresponding error was.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10pt;font-family:Arial,sans-serif">Brian Rose</span></b><span style="font-family:Arial,sans-serif"><br>
</span><i><span style="font-size:9pt;font-family:Arial,sans-serif">Staff Software Engineer</span></i><span style="font-size:9pt;font-family:Arial,sans-serif"><br>
</span><a href="mailto:brian.rose@sailpoint.com" target="_blank"><span style="font-size:9pt;font-family:Arial,sans-serif;color:rgb(0,181,226);text-decoration:none">brian.rose@sailpoint.com</span></a><span style="font-size:9pt;font-family:Arial,sans-serif;color:rgb(0,181,226)">
</span><span style="font-family:Arial,sans-serif"><br>
</span><a href="http://www.sailpoint.com" target="_blank"><b><span style="font-size:8pt;font-family:Arial,sans-serif;color:rgb(0,181,226);text-decoration:none">www.sailpoint.com</span></b></a><u></u><u></u></p>
</div>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> McAdams, Darin <<a href="mailto:darinm@amazon.com" target="_blank">darinm@amazon.com</a>> <br>
<b>Sent:</b> Wednesday, October 16, 2019 6:19 PM<br>
<b>To:</b> Brian Rose <<a href="mailto:brian.rose@sailpoint.com" target="_blank">brian.rose@sailpoint.com</a>>; <a href="mailto:openid-specs-fastfed@lists.openid.net" target="_blank">openid-specs-fastfed@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-fastfed] Question about 7.2.4 (Handshake Finalization)<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Good catch. Would it help if a signed JWT came along in this request as well?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed-bounces@lists.openid.net" target="_blank"><span style="font-size:12pt">openid-specs-fastfed-bounces@lists.openid.net</span></a><span style="font-size:12pt;color:black">>
on behalf of Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed@lists.openid.net" target="_blank"><span style="font-size:12pt">openid-specs-fastfed@lists.openid.net</span></a><span style="font-size:12pt;color:black">><br>
<b>Reply-To: </b>Brian Rose <</span><a href="mailto:brian.rose@sailpoint.com" target="_blank"><span style="font-size:12pt">brian.rose@sailpoint.com</span></a><span style="font-size:12pt;color:black">><br>
<b>Date: </b>Thursday, October 10, 2019 at 11:12 AM<br>
<b>To: </b>Openid-specs-fastfed <</span><a href="mailto:openid-specs-fastfed@lists.openid.net" target="_blank"><span style="font-size:12pt">openid-specs-fastfed@lists.openid.net</span></a><span style="font-size:12pt;color:black">><br>
<b>Subject: </b>[Openid-specs-fastfed] Question about 7.2.4 (Handshake Finalization)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">Hey all,<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">In my current POC implementation, I am attempting to set a flag to indicate that the full round trip has been completed in the finalization step. How does the Application Provider know the provider domain and the tenant id so that it can
verify that it has been previously whitelisted and update any associated data that the Application Provider might want to log? During the registration, the JWT contains all of the necessary information to do the look up. Also, as a result, is that this endpoint
is wide open.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thanks!<u></u><u></u></p>
<p class="MsoNormal">Brian Rose<u></u><u></u></p>
<p class="MsoNormal">SailPoint<u></u><u></u></p>
</div>
</div>
_______________________________________________<br>
Openid-specs-fastfed mailing list<br>
<a href="mailto:Openid-specs-fastfed@lists.openid.net" target="_blank">Openid-specs-fastfed@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fastfed" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fastfed</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div> <div style="padding:0px;margin:0px"> <table style="border-collapse:collapse;padding:0px;margin:0px"> <tbody><tr> <td style="width:113px"> <a href="https://www.pingidentity.com" target="_blank"></a><a href="https://www.pingidentity.com" target="_blank"><img alt="Ping Identity" src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/ping-logo.png"></a> </td> <td> <table> <tbody><tr> <td style="vertical-align:top"> <span style="color:rgb(230,29,60);display:inline-block;margin-bottom:3px;font-family:arial,helvetica,sans-serif;font-weight:bold;font-size:14px">Wesley Dunnington</span> <br> <span style="color:rgb(0,0,0);display:inline-block;margin-bottom:2px;font-family:arial,helvetica,sans-serif;font-weight:normal;font-size:14px">Field CTO East Region</span> <br>508-254-5475<br> <span style="font-family:arial,helvetica,sans-serif;font-size:14px;display:inline-block;margin-bottom:3px"><a href="mailto:wesleydunnington@pingidentity.com" target="_blank">wesleydunnington@pingidentity.com</a></span> <br> <span style="color:rgb(0,0,0);display:inline-block;margin-bottom:2px;font-family:arial,helvetica,sans-serif;font-weight:normal;font-size:14px"> </span> <br> <span style="color:rgb(0,0,0);display:inline-block;margin-bottom:2px;font-family:arial,helvetica,sans-serif;font-weight:normal;font-size:14px"> </span> </td> </tr> </tbody></table> </td> </tr> <tr> <td colspan="2"> <table style="border-collapse:collapse;border:none;margin:8px 0px 0px;width:100%"> <tbody><tr style="height:40px;border-top:1px solid rgb(211,211,211);border-bottom:1px solid rgb(211,211,211)"> <td style="font-family:arial,helvetica,sans-serif;font-size:14px;font-weight:bold;color:rgb(64,71,75)">Connect with us: </td> <td style="padding:4px 0px 0px 20px"> <a href="https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm" style="text-decoration:none;margin-right:16px" title="Ping on Glassdoor" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-glassdoor.png" style="border: none; margin: 0px;" alt="Glassdoor logo"></a> <a href="https://www.linkedin.com/company/21870" style="text-decoration:none;margin-right:16px" title="Ping on LinkedIn" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-linkedin.png" style="border: none; margin: 0px;" alt="LinkedIn logo"></a> <a href="https://twitter.com/pingidentity" style="text-decoration:none;margin-right:16px" title="Ping on Twitter" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-twitter.png" style="border: none; margin: 0px;" alt="twitter logo"></a> <a href="https://www.facebook.com/pingidentitypage" style="text-decoration:none;margin-right:16px" title="Ping on Facebook" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-facebook.png" style="border: none; margin: 0px;" alt="facebook logo"></a> <a href="https://www.youtube.com/user/PingIdentityTV" style="text-decoration:none;margin-right:16px" title="Ping on Youtube" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-youtube.png" style="border: none; margin: 0px 0px 3px;" alt="youtube logo"></a> <a href="https://www.pingidentity.com/en/blog.html" style="text-decoration:none;margin-right:16px" title="Ping Blog" target="_blank"><img src="https://www.pingidentity.com/content/dam/pic/images/misc/signature/social-blog.png" style="border: none; margin: 0px;" alt="Blog logo"></a> </td> </tr> </tbody></table> </td> </tr> </tbody></table><a href="https://www.google.com/url?q=https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/faqs/en/consumer-attitudes-post-breach-era-3375.pdf?id%3Db6322a80-f285-11e3-ac10-0800200c9a66&source=gmail&ust=1541693608526000&usg=AFQjCNGBl5cPHCUAVKGZ_NnpuFj5PHGSUQ" target="_blank"></a><a href="https://www.pingidentity.com/en/events/d/identify-2019.html" target="_blank"><img src="https://www.pingidentity.com/content/dam/ping-6-2-assets/images/misc/emailSignature/identify-email-image.png"></a> </div></div></div></div>
<br>
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)"><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"><font size="2">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i>