<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Mon, Feb 26, 2018 at 12:12 PM, Phil Hunt via Openid-specs-risc <span dir="ltr"><<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank" class="cremed">openid-specs-risc@lists.openid.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto">If oauth is assumed required than implicit cases are excluded since they do not have oauth in a significant number of cases. </div></blockquote><div><br></div><div>Implicit cases are not excluded, it is only assumed that they will use OAuth 2 for authorization. Not saying it has to be like that, just that there is no exclusion.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><br></div><div>If the intent is to require oauth then we need to agree on that because it excludes participants. <br></div></div></blockquote><div><br></div><div>Yes, we definitely need to agree.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><br><div id="m_8381603650010682904AppleMailSignature">Phil</div><div><div class="h5"><div><br>On Feb 26, 2018, at 12:04 PM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" class="cremed">dick@amazon.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<div class="m_8381603650010682904WordSection1">
<p class="MsoNormal">Implicit use cases would happen in SAML as well, would they not? The implicit use case would be an OIDC flow, not OAuth. There is shared user identifier in OAuth.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m confused by <span style="background:yellow">
this statement</span>. This RISC charter states:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Helvetica Neue";color:#5a5a5a;background:#fafafa">Internet accounts that use email addresses or phone numbers as the primary identifier for the account will be the initial focus.</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">What change in direction are you referring to?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-left:.5in">On 2/26/18, 11:55 AM, someone claiming to be "Phil Hunt" <<a href="mailto:phil.hunt@oracle.com" target="_blank" class="cremed">phil.hunt@oracle.com</a>> wrote:<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">My understanding was that implicit use cases exist because no oauth relationship exists. RISC is doing subject management because in the absence of oauth there is no explicit oauth consent. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="background:yellow">This exclusionary change in direction needs discussion and a consensus call.</span> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div>
<div id="m_8381603650010682904AppleMailSignature">
<p class="MsoNormal" style="margin-left:.5in">Phil<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<br>
On Feb 26, 2018, at 11:32 AM, Hardt, Dick <<a href="mailto:dick@amazon.com" target="_blank" class="cremed">dick@amazon.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a name="m_8381603650010682904__MailOriginalBody" class="cremed"> <u></u><u></u></a></p>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span>My feeling is that any RISC Profile should only deal in issues or opportunities unique to RISC.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span>I agree. If an aspect is clearly specified somewhere else, and meets RISC’s requirements, we should use it.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:1.0in"><span>It has not been clear what those RISC specific scoping issue are. Hence, I do not see the purpose for the current RISC Profile draft. For my part, I was expecting a
draft that actually defined RISC Events.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span>Dick commented on Feb 5 that:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span></span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_pipermail_openid-2Dspecs-2Drisc_Week-2Dof-2DMon-2D20180205_000439.html&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=na5FVzBTWmanqWNy4DpctyXPpuYqPkAI1aLcLN4KZNA&m=wj-hfBcSv3M7ndsxoK-cxJssgaJmDC7EagzTvgba_hc&s=Vd9UeCxGq9hZliDVJpZzz1m0VvKzPiquCradIos5QX0&e=" target="_blank" class="cremed"><span>http://lists.openid.net/<wbr>pipermail/openid-specs-risc/<wbr>Week-of-Mon-20180205/000439.<wbr>html</span><span></span></a><span><u></u><u></u></span></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre style="margin-left:1.0in;background:white;white-space:pre-wrap"><span>I think “need” is too strong. A single management API is desired.<u></u><u></u></span></pre>
<pre style="margin-left:1.0in;background:white"><span>Another aspect is that the management requirements of RISC, SCIM, OIDC etc. so far look quite different.<u></u><u></u></span></pre>
<pre style="margin-left:1.0in;background:white"><span>RISC has specific needs, and with a concrete API, there can more easily be a discussion on commonalities, or lack thereof with other SecEvent profiles.<u></u><u></u></span></pre>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><span>These statements don’t really play out. The RISC group has not really identified why RISC is unique. <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span>Let me clarify then. As I see it, RISC has the following control plane requirements:<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:1.0in">
<span><span>1)<span style="font:7.0pt "Times New Roman"">
</span></span>Add/remove subjects when the subject is not added implicitly
<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:1.0in">
<span><span>2)<span style="font:7.0pt "Times New Roman"">
</span></span>Check operational status of the event stream<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:1.0in">
<span><span>(1)<span style="font:7.0pt "Times New Roman"">
</span></span>Is not required by either OIDC or SCIM as subjects are determined implicitly by the protocol. Using SCIM for subject management in RISC has been deemed heavy for everyone except those already using SCIM. There currently is no WG document
in SecEvents for subject management.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:1.0in">
<span><span>(2)<span style="font:7.0pt "Times New Roman"">
</span></span>Is unique to SCIM. There currently is no WG document in SecEvents for subject management.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span>If SecEvents WG sees (1) and/or (2) to have common usage across SecEvents, and the SecEvents WG adopted a WG document for them, then it would make sense to not do that
work in RISC, but that is not the current state, and given the contention in SecEvents, I think it is important for the RISC WG to move forward and create specifications that meet its requirements.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span>I agree that RISC should be agnostic on what protocol is being used for how 2 parties have a mutual subject, be that OIDC, SAML, shared email, or shared phone number.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span> <u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span>/Dick<u></u><u></u></span></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div></blockquote></div></div></div></div><br>______________________________<wbr>_________________<br>
Openid-specs-risc mailing list<br>
<a href="mailto:Openid-specs-risc@lists.openid.net" class="cremed">Openid-specs-risc@lists.<wbr>openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-risc" rel="noreferrer" target="_blank" class="cremed">http://lists.openid.net/<wbr>mailman/listinfo/openid-specs-<wbr>risc</a><br>
<br></blockquote></div><br></div></div>