<div dir="ltr"><div>(Stan: Please move the repository access discussion to a new email thread)</div><div><br></div><div>Hi all,</div>Summarizing the discussion regarding categories from today's call here:<div><ol><li>"Revoke all tokens" is an example of an event type that can benefit from subject categories. Sometimes the event may apply to a user on all devices and at other times it may apply to all users on a specific device. Having a subject category within the subject will help disambiguate this scope.</li><li>If this information is made a part of the event type, it would make the event receiver more complex to code, with different logic to understand the subject of each event.</li><li>Adding multiple subject identifiers in the event increases the number of possible combinations that a receiver must support.</li><li>Having the "subject category" field is likely to reduce code-complexity and processing overhead, which will matter a lot at scale.</li></ol><div>As a result, instead of my initial email below, Tim said he will email the IETF SecEvents working group regarding these concerns around dropping the categories claim.</div></div><div><br></div><div>We can continue the discussion here on email so that we can clarify any concerns from within this working group before or while Tim posts on the SecEvents WG.</div><div><br></div><div>Atul<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 4, 2020 at 11:48 AM Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_8239143610339674348WordSection1">
<p class="MsoNormal"><span style="color:rgb(0,32,96)">Anyone can make pull requests to the repository by following the steps described at
</span><a href="http://lists.openid.net/pipermail/openid-specs-risc/Week-of-Mon-20200720/000734.html" target="_blank">http://lists.openid.net/pipermail/openid-specs-risc/Week-of-Mon-20200720/000734.html</a>. (These are exactly parallel to those you would use on GitHub or
GitLab.)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Typically OpenID working group chairs and editors have Write permissions to a working group repository – which lets them push directly to it and approve pull requests. Currently Annabelle, Atul, Marius, and Phil have write access. If
the chairs let me know who the active primary editors are, I can add them as well. (Those who are not primary editors should continue to create pull requests to be reviewed by the working group and merged by the primary editors or chairs.)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Hope this helps.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> -- Mike
<span style="color:rgb(0,32,96)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:rgb(0,32,96)"><u></u> <u></u></span></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b>From:</b> Openid-specs-risc <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank">openid-specs-risc-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Stan Bounev via Openid-specs-risc<br>
<b>Sent:</b> Tuesday, August 4, 2020 7:07 AM<br>
<b>To:</b> Tim Cappalli <<a href="mailto:Tim.Cappalli@microsoft.com" target="_blank">Tim.Cappalli@microsoft.com</a>>; Atul Tulshibagwale <<a href="mailto:atultulshi@google.com" target="_blank">atultulshi@google.com</a>>; Openid-specs-risc <<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank">openid-specs-risc@lists.openid.net</a>><br>
<b>Subject:</b> [EXTERNAL] Re: [Openid-specs-risc] Subject "categories" discussion<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Atul, I still have an issue with the access to the repo – getting Forbidden and error 403 when trying to push my changes. I will work separately on this. For today, I’d like to include the ‘compromised’ event for discussion.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black">Credential Compromised<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> Event Type URI:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black">
<a href="https://schemas.openid.net/secevent/risc/event-type/credential-" target="_blank">https://schemas.openid.net/secevent/risc/event-type/credential-</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> compromised<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> Credential Compromised event signals there is a leaked credential<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> with a specific domain that has been found online by the transmitter.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> Attributes: email address; user ID<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black">{<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "iss": "<a href="https://idp.example.com/" target="_blank">https://idp.example.com/</a>",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "jti": "756E69717565206964656E746966696572",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "iat": 1508184845,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "aud": "636C69656E745F6964",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "events": {<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "<a href="https://schemas.openid.net/secevent/risc/event-type/credential-compromised" target="_blank">https://schemas.openid.net/secevent/risc/event-type/credential-compromised</a>":
{<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "subject": {<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "subject_type": "iss-sub",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "iss": "<a href="https://idp.example.com/" target="_blank">https://idp.example.com/</a>",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "sub": "7375626A656374",<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> },<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> "credential-credential-id": "userID", "email_address"<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> }<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> }<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10pt;font-family:"Courier New";color:black"> }<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">Openid-specs-risc <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank">openid-specs-risc-bounces@lists.openid.net</a>> on
behalf of Tim Cappalli via Openid-specs-risc <<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank">openid-specs-risc@lists.openid.net</a>><br>
<b>Reply-To: </b>Tim Cappalli <<a href="mailto:Tim.Cappalli@microsoft.com" target="_blank">Tim.Cappalli@microsoft.com</a>><br>
<b>Date: </b>Tuesday, August 4, 2020 at 5:01 AM<br>
<b>To: </b>Atul Tulshibagwale <<a href="mailto:atultulshi@google.com" target="_blank">atultulshi@google.com</a>>, Openid-specs-risc <<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank">openid-specs-risc@lists.openid.net</a>><br>
<b>Subject: </b>Re: [Openid-specs-risc] Subject "categories" discussion<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif">Atul,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif">Can we use these scenarios (along with any other examples folks have) to continue the discussion today?
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:12pt;font-family:Arial,sans-serif">#1 “All sessions for this user and device are revoked”</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas">{</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "iss": "<a href="https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/" target="_blank">https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/</a>",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "jti": "756E69717565206964656E746966696572",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "iat": 1596468414,</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "aud": "636C69656E745F6964",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "events": {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "<a href="https://schemas.openid.net/secevent/caep/event-type/all-sessions-revoked" target="_blank">https://schemas.openid.net/secevent/caep/event-type/all-sessions-revoked</a>": {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "subject": [</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "subject_type": "iss_sub",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "iss": "<a href="https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/" target="_blank">https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/</a>",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "sub": "B82ABEF5-201B-4BDE-A532-F9827089009E" // User UUID</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> },</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> {</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "subject_type": "iss_sub",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "iss": "<a href="https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/" target="_blank">https://login.microsoft.com/72f988bf-86f1-41af-91ab-2d7cd011db47/</a>",</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> "sub": "208EE704-07BA-4762-B5CF-B45807E5FAA8" // Device UUID</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> }</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> ]</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> }</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> }</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas">}</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:12pt;font-family:Arial,sans-serif">#2 “All user sessions on this specific device are revoked”</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas">Same set with different event type?</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:Consolas"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-top:12pt"><span style="font-family:Arial,sans-serif"> </span><u></u><u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">Openid-specs-risc <<a href="mailto:openid-specs-risc-bounces@lists.openid.net" target="_blank">openid-specs-risc-bounces@lists.openid.net</a>><br>
<b>Date: </b>Friday, July 31, 2020 at 14:08<br>
<b>To: </b>Openid-specs-risc <<a href="mailto:openid-specs-risc@lists.openid.net" target="_blank">openid-specs-risc@lists.openid.net</a>><br>
<b>Subject: </b>[Openid-specs-risc] Subject "categories" discussion</span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Hi all,<u></u><u></u></p>
<div>
<p class="MsoNormal">In the OpenID SSE WG call on July 21st, we discussed at length the need for the "subject category" addition to the subject identifier. The notes from that call are
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1ZFwJJDwwSBNKX35VObClC1ctMbMMuHJtr5qY-7xsLW8%2Fedit%3Fusp%3Dsharing&data=02%7C01%7Ctim.cappalli%40microsoft.com%7C269ebb4c80c040001da808d8357cc0ad%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637318157241464997&sdata=BLHrBxsCR%2Ba4ZjFeYAfsLsg4b5o3CCZwfJgZ%2BFkecs8%3D&reserved=0" target="_blank">
here</a>.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Based on that discussion I would like to propose the following changes in the SSE profile draft and the proposed SSE Event Types draft:<u></u><u></u></p>
</div>
<div>
<ol start="1" type="1">
<li class="MsoNormal">
We drop the common claim named "category" from the subject identifiers.<u></u><u></u></li><li class="MsoNormal">
We specify in the SSE profile spec that individual events may have multiple subject-identifiers if required to disambiguate the subject as being in a specific category. The semantics of combining multiple subject identifiers within an event will always be "AND",
i.e. The subject of the event is identified by the intersection of the subjects identified by each subject identifier.<u></u><u></u></li><li class="MsoNormal">
In the proposed SSE event types spec, where required, we specify the multiple subject identifiers.<u></u><u></u></li></ol>
<div>
<p class="MsoNormal">Please respond here to discuss. This is relevant to the finalization of the subject identifiers specification in the IETF. I will post a message there based on the conclusion of any discussion here and in our next SSE WG call on 8/4.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Atul<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div>