<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Given that this is handled in OIDC discovery, I see this as an unjustified limitation. <div class=""><br class=""></div><div class="">If the intent is NOT to share claims, then it seems contradictory to force the UserInfo endpoint to be available.</div><div class=""><br class=""></div><div class="">If its available, should the UserInfo endpoint act like there are no claims are available? Should it return an unauthorized error? </div><div class=""><br class=""></div><div class="">Rather than be “simple” the proposal seems under-defined.</div><div class=""><br class=""></div><div class=""><div class=""><div class=""><div class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Aug 22, 2016, at 12:55 PM, John Bradley via Openid-specs-igov <<a href="mailto:openid-specs-igov@lists.openid.net" class="">openid-specs-igov@lists.openid.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">+1<br class=""><blockquote type="cite" class="">On Aug 22, 2016, at 4:46 PM, Justin Richer via Openid-specs-igov <<a href="mailto:openid-specs-igov@lists.openid.net" class="">openid-specs-igov@lists.openid.net</a>> wrote:<br class=""><br class="">+1 to this. The idea is that you want clients to know what to expect from a system. Being able to count on a user info endpoint to get *something* allows a simplification of code paths.<br class=""><br class="">— Justin<br class=""><br class=""><blockquote type="cite" class="">On Aug 22, 2016, at 3:36 PM, Mike Varley via Openid-specs-igov <<a href="mailto:openid-specs-igov@lists.openid.net" class="">openid-specs-igov@lists.openid.net</a>> wrote:<br class=""><br class="">Hi Phil - on a call back on July 26th we discussed the UserInfo endpoint requirement:<br class="">basically we err'd on the side of - Make it a MUST, and privacy conscious ecosystems can just return a 'sub' field with the pairwise anonymous identifier from the id_token (and no other fields - so no new information is actually returned in the UserInfo call). <br class=""><br class="">Also, we couldn't (at the time) think of scenarios where it would be a SHALL NOT. But we didn't think long on it :)<br class=""><br class="">If there are such scenarios, it's easy to change, we should just include the words to guide implementors on when they shall/should and shall not/should not.<br class=""><br class="">MV<br class=""><br class=""><br class=""><br class=""><br class="">On 2016-08-22, 2:42 PM, "Phil Hunt (IDM)" <<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">What is the reasoning for making UserInfo a MUST? I can see arguments for making it unavailable. For one many gov scenarios want to make sure tracking is not possible. So there may be scenarios that are SHALL NOT. <br class=""><br class="">Phil<br class=""><br class=""><blockquote type="cite" class="">On Aug 22, 2016, at 11:09 AM, Mike Varley via Openid-specs-igov <<a href="mailto:openid-specs-igov@lists.openid.net" class="">openid-specs-igov@lists.openid.net</a>> wrote:<br class=""><br class="">Hello all - I have updated the igov-profile spec on bitbucket with the following:<br class=""><br class="">- removed authMode parameter<br class="">- UserInfo endpoint support is now a MUST<br class="">- client_secret_jwt authentication mode added<br class=""><br class="">And some "scopes" that should help governments in defining profiles for their users, while allowing for cross-jurisdictional introp. And ID. This section will need a lot of discussion I hope - I was deliberately brief.<br class=""><br class="">Attached is an HTML version.<br class=""><br class="">Talk to you tomorrow,<br class=""><br class="">MV<br class=""><br class=""><openid-igov-profile-08-22.html><br class="">_______________________________________________<br class="">Openid-specs-igov mailing list<br class=""><a href="mailto:Openid-specs-igov@lists.openid.net" class="">Openid-specs-igov@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-igov<br class=""></blockquote><br class=""></blockquote>_______________________________________________<br class="">Openid-specs-igov mailing list<br class=""><a href="mailto:Openid-specs-igov@lists.openid.net" class="">Openid-specs-igov@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-igov<br class=""></blockquote><br class="">_______________________________________________<br class="">Openid-specs-igov mailing list<br class=""><a href="mailto:Openid-specs-igov@lists.openid.net" class="">Openid-specs-igov@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-igov<br class=""></blockquote><br class="">_______________________________________________<br class="">Openid-specs-igov mailing list<br class=""><a href="mailto:Openid-specs-igov@lists.openid.net" class="">Openid-specs-igov@lists.openid.net</a><br class="">http://lists.openid.net/mailman/listinfo/openid-specs-igov<br class=""></div></div></blockquote></div><br class=""></div></div></div></div></body></html>