<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif">
<div style="white-space:normal">
<p dir="auto">Hello folks,</p>
<p dir="auto">This week at TechEx, Ivan and I spent some time on an issue we had been seeing on SATOSA, namely that all claims returned from the SATOSA OP had single values even if the SATOSA internal representation of the attribute has multiple values.</p>
<p dir="auto">Upon further investigation and discussion with Mike Jones we realised that there is not just one way to represent multi-value claims in OIDC. As a matter of fact each claim should have its own specification of that what claim value should be.</p>
<p dir="auto">In the OIDC core specification:</p>
<ul>
<li>
<p dir="auto">all claims (except <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">
amr</code> in the ID token) are single valued.</p>
</li><li>
<p dir="auto">Three claims (<code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">given_name</code>,
<code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">
family_name</code>, <code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">
middle_name</code>) have the following description:</p>
<blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px">
<p dir="auto">Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.</p>
</blockquote>
</li><li>
<p dir="auto">Two claims (<code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">mail_verified</code>,
<code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">
phone_number_verified</code>) are booleans</p>
</li><li>
<p dir="auto"><code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">updated_at</code> is a number</p>
</li><li>
<p dir="auto"><code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">address</code> is JSON object</p>
</li><li>
<p dir="auto"><code style="background-color:#F7F7F7; border-radius:3px; margin:0; padding:0 0.4em" bgcolor="#F7F7F7">amr</code> is JSON array of strings</p>
</li><li>
<p dir="auto">everything else is string</p>
</li></ul>
<p dir="auto">The point of this e-mail, is that in the <a href="https://docs.google.com/document/d/1FQcZEUsjRjVxR5X5uii_Ma9adFIe9ER3b4WE-wYo7hU/edit#" style="color:#3983C4">
R&E id_token and userinfo endpoint claims</a> along with the mappings we need to describe what the type of each claim value is.</p>
<p dir="auto">So for example, eduPersonScopedAffiliation is a multi-value attribute in the eduPerson schema. Should we represent it as a JSON array or as space separated string (I hope you all say the former) when mapped to OIDC.</p>
<p dir="auto">Christos</p>
<p dir="auto">PS</p>
<p dir="auto">Where is the discussion/document happening about other mappings beyond R&S?</p>
<p dir="auto">--<br>
Christos Kanellopoulos<br>
Senior Trust & Identity Manager<br>
GÉANT<br>
M: +31 611 477 919</p>
<p dir="auto">Networks • Services • People<br>
Learn more at <a href="http://www.geant.org%E2%80%8B" style="color:#3983C4">www.geant.org</a></p>
<p dir="auto">GÉANT Vereniging (Association) is registered with the Chamber of Commerce in Amsterdam with registration number 40535155 and operates in the UK as a branch of GÉANT Vereniging. Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands.
UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK.</p>
</div>
</div>
</body>
</html>