[Id-event] Subject categories

Atul Tulshibagwale <atultulshi@google.com> Wed, 19 August 2020 18:05 UTC

MIME-Version: 1.0
From: Atul Tulshibagwale <atultulshi@google.com>
Date: Wed, 19 Aug 2020 11:05:01 -0700
Message-ID: <CAMCkG5sj7wQPHLRwmV1TTWA+r=Fgyz5pSOA3dUwurVEdTa-o_Q@mail.gmail.com>
To: Openid-specs-risc <openid-specs-risc@lists.openid.net>
Cc: SecEvent <id-event@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000005771a805ad3ed88c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/id-event/cibBLqdRVM_hcn6wCE3gj1Pb8i0>
Subject: [Id-event] Subject categories
Precedence: list

Hi all,
As agreed on the SSE call yesterday, I'd like to present a use-case where I
believe subject categories within a subject identifier are useful. I
encourage others to also send such emails in advance of the call next
Tuesday, so that there's more clarity on the viewpoints and use-cases.

My use case:
Say a SSE Transmitter wants to signal that the authentication for a certain
user on a certain device has weakened (due to some change initiated,
observed or inferred by the transmitter). The user may have authenticated
to many devices, and one device may have sessions for multiple users.

In this case, the possibilities for conveying such information through an
event are:

   1. Include two subject identifiers in a single event. The SSE spec can
   define that when multiple subjects are present within the same event, the
   subject is identified as an "AND" of all such subject identifiers. This was
   a point of confusion in yesterday's call, but I believe this can be
   clarified in the specification and will not be a point of confusion once
   clarified. Each subject identifier specifies the category that it applies
   to. (i.e, one subject identifier is for the user category and another for
   the device category)
   2. Define the "authentication status change" event such that it can take
   multiple optional fields. A field can be "user", another can be "device"

Sending multiple events, one with a user subject and another with a device
subject is not really a choice because it will mean the first event applies
to everywhere the user is logged in to, and the second event applies to all
users logged into the device.

Having the subject category will help if the user is identified by the
subject identifier type "phone number", to clarify that the subject refers
to the user and not the device.

Option 1 is better because it is independent of the event type. Processing
multiple subject identifiers with a well defined combination semantics will
help identify subjects that the event applies to in advance of processing
the specific event.

Option 2 intertwines the logic of event processing with subject
identification and can cause an implementer to have more code that differs
slightly in handling each event that has multiple subject possibilities.

Atul

[Id-event] Subject categories Atul Tulshibagwale