<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">So, in both cases, what Adam says works with eventing principles. In your case, you would issue an event along the lines of Subject personal identifier added or removed. <div class=""><br class=""></div><div class="">For example, if <a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a> registered with Amazon, you would figure out that Oracle,com will want to know, if the user (me) gave Amazon the consent, my profile would be added to the Amazon->Oracle feed. Amazon then immediately sends the identifier (or account) added event to <a href="http://oracle.com" class="">Oracle.com</a>. Notice that the event is simply a notification that a subject has changed state AT amazon. It is in no way a command.<div class=""><br class=""></div><div class="">Then, upon receiving the event from Amazon, <a href="http://oracle.com" class="">Oracle.com</a> is informed that the Subject personal identifier (<a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>) was added at Amazon. The Oracle system consults local policy, obtains consent if necessary and then adds <a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a> to the reciprocating feed for Amazon.</div><div class=""><br class=""></div><div class="">When I close my account at Amazon, the exact same process occurs. Amazon issues an account closed notification (or just identifier removed). Oracle clears the subject from its reciprocating feed if appropriate. Oracle may also make other conclusion.</div><div class=""> </div><div class="">AN IMPORTANT OBSERVATION: Adam has talked about how the addition of an identifier (e.g. an email address) is also itself a security event because hackers will often do this. So in this example, Oracle (the IDP for <a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a>) may also mark my account as potentially under attack for a period of time in its own security system.</div><div class=""><br class=""></div><div class="">This is an example of the power of eventing. Rather than sending a command from Amazon to Oracle, Amazon simply states a fact that has occurred in its own domain and the receiver and draw its own conclusions to act upon it. In this case, the relationship is identified and the feeds are updated, but ALSO the security systems are notified in case <a href="mailto:phil.hunt@oracle.com" class="">phil.hunt@oracle.com</a> has been hijacked.</div><div class=""><br class=""></div><div class="">Have I got this right Adam?</div><div class=""><br class=""></div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><span class="Apple-style-span" style="border-collapse: separate; line-height: normal; border-spacing: 0px;"><div class="" style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div class=""><div class=""><div class="">Phil</div><div class=""><br class=""></div><div class="">Oracle Corporation, Identity Cloud Services & Identity Standards</div><div class="">@independentid</div><div class=""><a href="http://www.independentid.com" class="">www.independentid.com</a></div></div></div></div></span><a href="mailto:phil.hunt@oracle.com" class="" style="orphans: 2; widows: 2;">phil.hunt@oracle.com</a></div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Mar 2, 2017, at 1:04 PM, Hardt, Dick <<a href="mailto:dick@amazon.com" class="">dick@amazon.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">Sorry I did not include my use cases and am making you dig for them.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">You have described the two use cases:<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman'; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><span class="">1)<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri;" class="">User has opted out of Amazon and Google exchanging information. We want to tell Google we will no longer be sending signals, and ask Google to no longer send us signals.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman'; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><span class="">2)<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri;" class="">User has removed the email address from their Amazon account. Again, we want to let Google know we will no longer be sending signals, and that we no longer want Google to send us signals.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">As for why do we need to tell Google to not send us signals, we do not want to receive information we should not see. A tenant of security is to not have access to something you don’t need. We would prefer to not receive the signal, rather than have to filter it out and drop it. We want to minimize the information we get. There are nuances about why that are not appropriate for discussion publicly.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">/Dick<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""><o:p class=""> </o:p></span></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">On 3/2/17, 12:01 AM, someone claiming to be "Adam Dawes" <<a href="mailto:adawes@google.com" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="border: 1pt solid windowtext; padding: 0in;" class=""><object border="0" width="32" height="32" id="_x0000_i1025" alt="mage removed by sender." class="" data="cid:Word%20Work%20File%20D_1.jpg" type="application/x-apple-msg-attachment"></object></span><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">On Wed, Mar 1, 2017 at 7:32 PM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" style="color: purple; text-decoration: underline;" class="">dick@amazon.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">If Amazon says it no longer wants any events from oracle on subject X, that is clearly a command.</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">I'm trying to understand that that really means. Amazon agrees that it will no longer look for any 3rd party signals related to account security for that user? Does that mean Amazon is no longer interested in password dumps that are on the internet to try to better secure the account? That doesn't seem to make any sense. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">I understand you are trying to get at some privacy choice expressed by the user on Amazon. I think that's the wrong model. The privacy event happens with the Transmitter and that's where the user's preference to not disclose to 3rd parties should take place. I think the actual RISC event of interest that corresponds to your use case Dick, is email address changed or account deleted at Amazon. Those are totally valid RISC signals and it would be fully appropriate for the Transmitter to no longer send info about that user to Amazon anymore.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">I understand that we're kind of mixing the control plane and data plane here. But going back to past conversations, the idea was that both Transmitters and Receivers weren't compelled to do anything in particular. I think this is more feature than bug. <o:p class=""></o:p></div></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri; color: rgb(136, 136, 136);" class=""> </span><span style="color: rgb(136, 136, 136);" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri; color: rgb(136, 136, 136);" class="">/Dick</span><span style="color: rgb(136, 136, 136);" class=""><o:p class=""></o:p></span></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class="">On 3/1/17, 7:06 PM, someone claiming to be "Phil Hunt (IDM)" <<a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class="">Depends on what you are expressing. If you are saying amazon has an interest in subject x, it is an event compatible with data plane. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class="">If you are saying amazon wants oracle to deliver events on subject x, that is a command and must be part of control. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class="">The problem is that no party should be forced to disclosed events because a third party says so. They must get consent from their subject. We should get legal to confirm this. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class="">My thought is that the event causes the receiver to subsequently confirm with the user for permission. <br class=""><br class="">Phil<o:p class=""></o:p></div></div><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt 1in; font-size: 12pt; font-family: 'Times New Roman';"><br class="">On Mar 1, 2017, at 4:46 PM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" style="color: purple; text-decoration: underline;" class="">dick@amazon.com</a>> wrote:<o:p class=""></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">Mixing control plane and data plane is very concerning to me.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">That is considered an anti-pattern in AWS. It complicates development, security and operations.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">/Dick</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">On 2/28/17, 10:24 PM, someone claiming to be "Adam Dawes" <<a href="mailto:adawes@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">Thanks for bringing this up Dick. I think you're worried about, when<span class="Apple-converted-space"> </span><a href="mailto:alice@gmail.com" target="_blank" style="color: purple; text-decoration: underline;" class="">alice@gmail.com</a><span class="Apple-converted-space"> </span>signs up for an account at Amazon, how would Amazon register to get events from Google. I think we can deal with this if Amazon sends a SET token to google with an "account created" event which would then create a registration at google for Amazon to receive events about alice@.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">I think it is totally reasonable to think of account creation as a notifiable event. And in typical RISC fashion, it is up to the recipient to do what it will with the events. From Google's perspective, we would white list a set of partners where we have contracts to enable implicit registration. I think we should work out some response codes to make it clear to the sender whether the registration succeeded.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">We didn't talk a lot about this in the F2F but is an idea that I had in my deck and I think it came up in Phil and my conversation last week. Phil, does the above give you any concerns? <o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">On Tue, Feb 28, 2017 at 9:12 AM, Phil Hunt (IDM) <<a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">RISC use case is typically bi-directional so events can be used. It also works better because usually a receiver may add only or drop only depending on implicit or explicit federation. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">Adam argued for all other update items to be done OOB. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">That just left error signalling for the receiver to find out why events were not coming. <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div id="m_-7788871969743135199m_8417452791228652780AppleMailSignature" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">We left it that scim can be quickly added for those that want full automated CRUD (oracle does). Buy it would not be required in core. <span style="color: rgb(136, 136, 136);" class=""><br class=""><br class=""><span class="m-7788871969743135199hoenzb">Phil</span></span><o:p class=""></o:p></div></div><div class=""><div class=""><div class=""><p class="MsoNormal" style="margin: 0in 0in 12pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';"><br class="">On Feb 28, 2017, at 8:32 AM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" style="color: purple; text-decoration: underline;" class="">dick@amazon.com</a>> wrote:<o:p class=""></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">Perhaps I am missing it, but I don’t see a mechanism for the receiver to add / delete which subjects the receiver is interested in. Is this not included, or am I misunderstanding what is below?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">Or is that out of scope? If so, that seems odd as there is a control plane API in (3)</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class="">/Dick</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="font-size: 11pt; font-family: Calibri;" class=""> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">On 2/28/17, 12:53 AM, someone claiming to be "Openid-specs-risc on behalf of Adam Dawes" <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank" style="color: purple; text-decoration: underline;" class="">openid-specs-risc-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span>on behalf of<a href="mailto:adawes@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a>> wrote:<o:p class=""></o:p></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">I think this is great Phil. Thanks again for the detailed conversation where we were able to arrive at this.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">On Mon, Feb 27, 2017 at 1:35 PM, Phil Hunt <<a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class="">phil.hunt@oracle.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin: 5pt 0in 5pt 4.8pt;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">Please confirm if you agree with the following:<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">I had previously promised to break up the distribution draft into components. I ran into some difficulty as to how subscribers (receivers) of events find out if the publisher is having problems delivering events. <o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">After some discussion with the RISC WG folks and Adam Dawes, I would like to propose that I break out a SET Transmission draft that includes the following:<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">1. Basic HTTPS POST profile to a specified endpoint. It is up to the receiver to provide fault tolerance and high-availability that meets its own delivery assurance requirements.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">2. A set of metadata that describes the endpoints, the encryption methods (eg. keys for signing and encrypting JWTs) etc.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">3. A simple control plane API that allows a subscriber (receiver) to perform an HTTPS GET to obtain the current configuration and subscription (stream) status. While compatible with SCIM, it will NOT require SCIM to be implemented. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">4. Configuration of subscriptions (streams) is done through out-of-scope administrative processes offered by event publishers.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">5. In the initial profile, subscribers will not be able to “pause” streams automatically unless offered through the administrative interface of the publisher.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">If people have a need for automated management, the basic idea is that you implement the POST and PATCH methods of SCIM and you are good to go. We don’t need to spend a lot of time on it as there is nothing special to do once the metadata for streams is defined.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">Does this work for everyone?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class="">Phil</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class="">Oracle Corporation, Identity Cloud Services & Identity Standards</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class="">@independentid</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""><a href="http://www.independentid.com/" target="_blank" style="color: purple; text-decoration: underline;" class="">www.independentid.com</a></span><o:p class=""></o:p></div></div></div></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""><a href="mailto:phil.hunt@oracle.com" target="_blank" style="color: purple; text-decoration: underline;" class="">phil.hunt@oracle.com</a></span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""> </span><o:p class=""></o:p></div></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""> </span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""> </span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><span style="" class=""> </span><o:p class=""></o:p></div></div><p class="MsoNormal" style="margin: 0in 0in 12pt 2in; font-size: 12pt; font-family: 'Times New Roman';"> <o:p class=""></o:p></p></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div></div><p class="MsoNormal" style="margin: 0in 0in 12pt 2in; font-size: 12pt; font-family: 'Times New Roman';"><br class="">_______________________________________________<br class="">Id-event mailing list<br class=""><a href="mailto:Id-event@ietf.org" target="_blank" style="color: purple; text-decoration: underline;" class="">Id-event@ietf.org</a><br class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" target="_blank" style="color: purple; text-decoration: underline;" class="">https://www.ietf.org/mailman/listinfo/id-event</a><o:p class=""></o:p></p></blockquote></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""><br class=""><br clear="all" class=""><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class="">--<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin-top: 7.5pt;" class=""><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman'; line-height: 18pt;" class=""><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(213, 15, 37); padding: 2pt;" class="">Adam Dawes |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(51, 105, 232); padding: 2pt;" class=""> Sr. Product Manager |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(0, 153, 57); padding: 2pt;" class=""> <a href="mailto:adawes@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a> |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(238, 178, 17); padding: 2pt;" class=""> +1<span class="Apple-converted-space"> </span><a href="tel:(650)%20214-2410" target="_blank" style="color: purple; text-decoration: underline;" class="">650-214-2410</a></span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 2in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div></div></div></div></div></blockquote></div></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><br class=""><br clear="all" class=""><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">--<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin-top: 7.5pt;" class=""><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman'; line-height: 18pt;" class=""><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(213, 15, 37); padding: 2pt;" class="">Adam Dawes |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(51, 105, 232); padding: 2pt;" class=""> Sr. Product Manager |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(0, 153, 57); padding: 2pt;" class=""> <a href="mailto:adawes@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a> |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(238, 178, 17); padding: 2pt;" class=""> +1<span class="Apple-converted-space"> </span><a href="tel:(650)%20214-2410" target="_blank" style="color: purple; text-decoration: underline;" class="">650-214-2410</a></span><o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""> <o:p class=""></o:p></div></div></div></div></div></blockquote></div></div></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><br class=""><br clear="all" class=""><o:p class=""></o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class="">--<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div class=""><div class=""><div style="margin-top: 7.5pt;" class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman'; line-height: 18pt;" class=""><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(213, 15, 37); padding: 2pt;" class="">Adam Dawes |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(51, 105, 232); padding: 2pt;" class=""> Sr. Product Manager |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(0, 153, 57); padding: 2pt;" class=""> <a href="mailto:adawes@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">adawes@google.com</a> |</span><span style="font-family: Helvetica; color: rgb(85, 85, 85); border: 1.5pt solid rgb(238, 178, 17); padding: 2pt;" class=""> +1 650-214-2410</span><span style="font-family: Helvetica; color: rgb(85, 85, 85);" class=""><o:p class=""></o:p></span></div></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman';" class=""><o:p class=""> </o:p></div></div></div></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;" class="">Id-event mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="mailto:Id-event@ietf.org" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">Id-event@ietf.org</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""><a href="https://www.ietf.org/mailman/listinfo/id-event" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class="">https://www.ietf.org/mailman/listinfo/id-event</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);" class=""></div></blockquote></div><br class=""></div></div></body></html>