[Id-event] Thread - Should Primary Event Be a Separate Attribute (regarding secevent-token-00)

[Phil Hunt <[e-mail]>]

All,

Yaron asked me to go over all of the items marked “Thread” in the following email: https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY <https://mailarchive.ietf.org/arch/msg/id-event/u99clKDCPTrqEkOxvJpd402jXjY>

This is the first of several threads:  Should Primary Event Be a Separate Attribute

On this topic, following Yaron’s comments Mike Jones raised some points that there should be no distinction between primary events and extensions (https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U <https://mailarchive.ietf.org/arch/msg/id-event/0Hhg46ROcidQDLL7OnXUs88TJ9U>).  Summarizing:
* Processors will run through all of them regardless. It is not necessarily helpful to understand which is a primary vs. extension
* Let’s drop distinction between primary vs. extension. You can simply express one or more sets of event attributes in a single JWT

My proposal is to drop this terminology in the text and keep the attribute multi-valued. The purpose of the attribute is to inform the reader what events are being asserted and what additional data may be present. It is up to the reader to ultimately infer meaning when one or more URIs are present.  Further, when multiple URIs are present it must still to make a combined statement about a single state change about a subject. It must not be used to convey multiple distinct (e.g. transactions) events about a subject.

Assuming everyone agrees, I will plan to remove these distinctions in the next update with some new text. Please comment if you have concerns.
Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com <http://www.independentid.com/>[e-mail] <mailto:[e-mail]>