<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have two questions about how to encode subjects in SSE events:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<ol>
<li>In <a href="https://openid.net/specs/openid-sse-framework-1_0-01.html#subject-ids" title="https://openid.net/specs/openid-sse-framework-1_0-01.html#subject-ids">
section 3</a> of the SSE Framework spec it says that a claim of Subject type can have
<i>any</i> name and section 3.1 shows an example with "transferrer" as the claim. All of the examples in the CAEP and RISC specs use "subject" as the claim. Should there be something in the specification that enforces the use of "subject" as the claim name?
If not, how should receivers know how to parse the event?</li><li>In the CAEP spec the examples all show the subject type indicated with the "format" field, which appears to be correct as described in
<a href="https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers#section-3" title="https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers#section-3">
section 3 of the Subject Identifiers spec</a>. However, in the RISC spec all of the examples show that the subject type is identified with a "subject_type" field. Are the RISC spec examples incorrect? </li></ol>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="box-sizing:border-box; border-collapse:collapse; border-spacing:0px; max-width:100%; color:rgb(51,51,51); font-family:"Helvetica Neue",Helvetica,Arial,sans-serif; font-size:12px; text-align:start">
<tbody style="box-sizing:border-box">
<tr style="box-sizing:border-box">
<td width="50" style="box-sizing:border-box"><img width="50" height="50" style="box-sizing:border-box; vertical-align:middle; display:block" src="https://duo.com/assets/img/email/duo-logo-email-signature.gif"></td>
<td width="10" style="box-sizing:border-box"><img width="10" height="50" style="box-sizing:border-box; vertical-align:middle; display:block" src="https://duo.com/assets/img/email/spacer.gif"></td>
<td style="box-sizing:border-box">
<div style="box-sizing:border-box; margin:0px; font-family:Helvetica,sans-serif; display:inline">
<strong style="box-sizing:border-box; font-weight:bold; display:inline">Shayne Miel</strong><span> </span>
<div style="box-sizing:border-box; margin:0px; display:inline"><span style="box-sizing:border-box; color:rgb(153,153,153)">/</span><span> </span><span style="box-sizing:border-box">Engineering Technical Leader (he, him, his)</span></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box">
<a href="mailto:smiel@cisco.com" style="box-sizing:border-box; color:rgb(99,178,70)">smiel@cisco.com</a></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box">
<span style="box-sizing:border-box">(919) 923-6230</span><span style="box-sizing:border-box"></span></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box; display:inline">
<a href="https://duo.com/" style="box-sizing:border-box; color:rgb(99,178,70)">Duo.com</a></div>
</div>
</td>
<td style="box-sizing:border-box"><img width="1" height="50" style="box-sizing:border-box; vertical-align:middle; display:block" src="https://duo.com/assets/img/email/spacer.gif"></td>
</tr>
<tr style="box-sizing:border-box">
<td colspan="4" style="box-sizing:border-box">
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box">
<span style="box-sizing:border-box; display:inline">----------<br style="box-sizing:border-box">
Duo Security is<span> </span><a href="https://duo.com/about/press/releases/cisco-completes-acquisition-of-duo-security" style="box-sizing:border-box; color:rgb(99,178,70)">now part of Cisco</a>.</span></div>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>