[Id-event] JWT claim name in draft-ietf-secevent-subject-identifiers?

[Brian Campbell <[e-mail]>]

During the meeting in Bangkok I asked about whether this document should
define a JWT claim for subject identifier and said I'd followup on the list
with the question. It took me a while to get to that but here it is.

Some background behind the question is that I was working on some examples
for the draft OpenID Connect Client Initiated Backchannel Authentication
<https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html>
specification and there was a place where a subject identifier in a JWT
seemed like a good fit for one of the examples (where the calling client
makes a request that has have some way of identifying the end-user and in a
token is one such way). So I consulted
draft-ietf-secevent-subject-identifiers-02
<https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers-02>
to see how to do it and was somewhat surprised to find that there wasn't a
JWT claim name defined to carry the subject identifier. I ended up using
"subject" in the login_hint_token parameter at the end of
https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#auth_request
because it seemed the closest thing to convention there was.

But that left me wondering why draft-ietf-secevent-subject-identifiers-02
hadn't defined a claim and whether maybe it should. Or, if not, whether
maybe a bit of explanation as to why not might be useful and/or some
guidance to users of subject-identifiers or specifications using or
profiling it about the need to agree on a claim name that will carry the
subject identifier value.


On Tue, Oct 23, 2018 at 2:06 PM <[e-mail]> wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Security Events WG of the IETF.
>
>         Title           : Subject Identifiers for Security Event Tokens
>         Authors         : Annabelle Backman
>                           Marius Scurtescu
>         Filename        : draft-ietf-secevent-subject-identifiers-02.txt
>         Pages           : 10
>         Date            : 2018-10-23
>
> Abstract:
>    Security events communicated within Security Event Tokens may support
>    a variety of identifiers to identify the subject and/or other
>    principals related to the event.  This specification formalizes the
>    notion of subject identifiers as named sets of well-defined claims
>    describing the subject, a mechanism for representing subject
>    identifiers within a [JSON] object such as a JSON Web Token [JWT] or
>    Security Event Token [SET], and a registry for defining and
>    allocating names for these claim sets.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-secevent-subject-identifiers/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-secevent-subject-identifiers-02
>
> https://datatracker.ietf.org/doc/html/draft-ietf-secevent-subject-identifiers-02
>
> A diff from the previous version is available at:
>
> https://www.ietf.org/rfcdiff?url2=draft-ietf-secevent-subject-identifiers-02
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._