Re: [Ace] Update of access rights

[Jim Schaad <[e-mail]>]

I have not had a chance to think this out and get all of the implications
right, but my understanding is that what we were trying to avoid was having
the same secret key/public key present on the RS in more than one token.
This simplifies what the RS needs to do.  However, I am now under the
impression that having the RS deal with multiple tokens with the same public
key might be less of an issue than trying to make some decisions on what
tokens are supposed to supersede other tokens.

One of the ways that this might be avoided is to push the problem to where
it, in some sense, belongs.  The AS should be able to make this type of
decision if a token is supposed to replace an existing token or not and it
has more knowledge about what tokens are associated with what keys.  If we
go back and say - the AS should include a CWTID in the token and then define
a new claim which says - This token supersedes the token(s) with CWTID
values of "x", "y" and "z".  

Jim