<div dir="ltr"><div>Joining a little late... </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">why not implement something that's already in the spec and in a way that is<br>much more scalable<br></blockquote><div>I think this makes a lot of sense. Rather than rolling our own thing and pushing for adoption, referring to the standard and encouraging people to implement it seems a much better solution. </div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 20 May 2019 at 20:54, Mischa Salle <<a href="mailto:msalle@nikhef.nl">msalle@nikhef.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Mon, May 20, 2019 at 08:49:39PM +0200, Roland Hedberg wrote:<br>
> Hi Mischa,<br>
> <br>
> I think that why the discuss started on not relying on using the<br>
> claims parameter was that some implementations (most notably<br>
> PingFederate) didn’t support it.<br>
> <br>
> Now, it turns out that we are not the only community that are looking<br>
> at claims to solve a problem.<br>
> Which will hopefully make implementers take note and actually support it.<br>
which would indeed be great.<br>
<br>
My point however was even stronger. In order to support the scenarios<br>
such as <a href="https://scitokens.org/technical_docs/Claims#scitokens-scopes" rel="noreferrer" target="_blank">https://scitokens.org/technical_docs/Claims#scitokens-scopes</a><br>
driven by e.g. WLCG, people will have to implement new things, so why<br>
not implement something that's already in the spec and in a way that is<br>
much more scalable (since you can easily request claim/claimvalue<br>
pairs)?<br>
<br>
> Using scope to solve the dataminimalization problem has always been a kludge.<br>
I fully agree...<br>
<br>
Best wishes,<br>
Mischa<br>
<br>
> <br>
> > On 20 May 2019, at 20:39, Mischa Salle <<a href="mailto:msalle@nikhef.nl" target="_blank">msalle@nikhef.nl</a>> wrote:<br>
> > <br>
> > Hi all,<br>
> > <br>
> > after reading Torsten's very nice blogpost [1], and Nat Sakimura's<br>
> > answer [2], (thanks to Jim Basney for pointing it out on the<br>
> > <a href="mailto:discuss@scitokens.org" target="_blank">discuss@scitokens.org</a> mailing list [3]) I started wondering why we<br>
> > actually are not using the claims request [4].<br>
> > The reason we started using 'scopes per claim' is because of a lack of<br>
> > support for the 'claims parameter', which is optional in the spec,<br>
> > unlike the 'scope' parameter which is always supported. But now we've<br>
> > gotten to the point where we need to put structure in the scopes, things<br>
> > like "read:/foo" and the like, but using that would *also* require<br>
> > support for non-standard things in client- and server software...?<br>
> > So, am I missing something or have we just made a nice circle?<br>
> > <br>
> > Best wishes,<br>
> > Mischa<br>
> > <br>
> > <br>
> > [1] <a href="https://medium.com/oauth-2/transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-2326e2038948" rel="noreferrer" target="_blank">https://medium.com/oauth-2/transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-2326e2038948</a><br>
> > [2] <a href="https://nat.sakimura.org/2019/05/12/comments-back-to-transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-by-torsten/" rel="noreferrer" target="_blank">https://nat.sakimura.org/2019/05/12/comments-back-to-transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-by-torsten/</a><br>
> > [3] <a href="https://groups.google.com/a/scitokens.org/forum/#!topic/discuss/bpshiUuqRtg" rel="noreferrer" target="_blank">https://groups.google.com/a/scitokens.org/forum/#!topic/discuss/bpshiUuqRtg</a><br>
> > [4] <a href="https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter" rel="noreferrer" target="_blank">https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter</a><br>
> > <br>
> > -- <br>
> > Nikhef Room H155<br>
> > Science Park 105 Tel. +31-20-592 5102<br>
> > 1098 XG Amsterdam Fax +31-20-592 5155<br>
> > The Netherlands Email <a href="mailto:msalle@nikhef.nl" target="_blank">msalle@nikhef.nl</a><br>
> > __ .. ... _._. .... ._ ... ._ ._.. ._.. .._..<br>
> > -- <br>
> > openid-specs-rande mailing list<br>
> > <a href="mailto:openid-specs-rande@lists.openid.net" target="_blank">openid-specs-rande@lists.openid.net</a><br>
> > <a href="http://lists.openid.net/mailman/listinfo/openid-specs-rande" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-rande</a><br>
> <br>
> — Roland<br>
> Scratch a pessimist and you find often a defender of privilege. -William Beveridge, economist and reformer (5 Mar 1879-1963) <br>
> <br>
<br>
-- <br>
Nikhef Room H155<br>
Science Park 105 Tel. +31-20-592 5102<br>
1098 XG Amsterdam Fax +31-20-592 5155<br>
The Netherlands Email <a href="mailto:msalle@nikhef.nl" target="_blank">msalle@nikhef.nl</a><br>
__ .. ... _._. .... ._ ... ._ ._.. ._.. .._..<br>
-- <br>
openid-specs-rande mailing list<br>
<a href="mailto:openid-specs-rande@lists.openid.net" target="_blank">openid-specs-rande@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-rande" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-rande</a><br>
</blockquote></div></div>