Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

[Benjamin Kaduk <[e-mail]>]

Sorry for the delay.

On 03/07/2017 12:20 PM, Phil Hunt wrote:
> Thanks Mike,
>
> Just to be clear. You are expressing a perspective of maintaining the
> exact format as defined by the ID Token and imposing the limit on all
> other Events.  
>
> If I understand correctly, JWT (RFC7519) has no such limitation on sub
> and the group *could* choose to profile “sub” to be globally unique
> for all SET Events. Correct?
>
> What I was trying to do was point out the 3 separate subject
> identification formats already in the spec and to ask, is this really
> acceptable (per Yaron’s request)?
>
> You and William have indicated a preference to leave it. 
>
> Justin and Benjamin did apparently express some concerns. Can they
> clarify?
>

My preference would be your "4th option" to always have "sub" and "iss"
in the events payload, even if "iss" is the same in the outer envelope
and the events payload -- it's unambiguous and easy to interpret.  Mike
has mostly convinced me that there exist environments when the two "iss"
are absolutely required to be identical and are strictly duplicated
(which lends itself naturally to the status quo).  But since I don't
understand these cases very well, I'm concerned about how to identify
those environments and whether there would be interop issues if such an
environment contained an actor that also had to interact with a more
generic environment.

> My concern is that we are too compatible with existing code. SETs can
> easily be confused as ID Tokens as existing ID Token parsers will
> ignore the events attribute and will see all the normal claims for an
> ID Token as being present.  If you can address this, then I can live
> with the status quo.
>

I don't think I have anything to offer to help on the disambiguation of
ID tokens and SETs issue.

-Ben

> Are they any that have issues with the current draft (in order to get
> back to Yaron’s question)? The current draft allows multiple iss
> values to appear in different places in the JSON structure based on
> profiling specification definition.
>
> Phil
>
> Oracle Corporation, Identity Cloud Services & Identity Standards
> @independentid
> www.independentid.com
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=Ijhk2wjlr4V4-fswCLBGE38fdK1gwFfUY66tfJf7a24&e=>
> [e-mail] <mailto:[e-mail]>
>
>
>
>
>
>
>
>> On Mar 7, 2017, at 9:29 AM, Mike Jones <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>
>> No, it’s not possible to require that “sub” be globally unique
>> because for important use cases, it’s relative to the issuer.  Trying
>> to force it to be a URI would unnecessarily limit the applicability
>> of the SET spec, causing some applications to simply decide to not
>> use it as a result.
>>  
>> If some use cases want a kind of logout event that’s issued by a
>> different party than the IdP, then the current spec lets that new
>> event be defined.  It will require more parameters than the current
>> logout event, but that’s OK, since it’s used in different contexts.
>>  
>> In my view, it’s not editorially lazy to allow events to define what
>> claims they need.  It’s an intentional choice, which enables the
>> simple cases to be simply expressed, while also enabling more
>> complicated cases carrying more information to be expressed.
>>  
>> Trying to force the simple events use extra syntax only actually
>> needed for complicated events would be a severe architectural mistake
>> on our part.
>>  
>>                                                        -- Mike
>>  
>> *From:* Id-event [mailto:[e-mail]] *On Behalf
>> Of *Phil Hunt
>> *Sent:* Tuesday, March 7, 2017 8:13 AM
>> *To:* ID Events Mailing List <[e-mail]
>> <mailto:[e-mail]>>
>> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in
>> SET tokens
>>  
>>  
>> Just to refresh everyone...
>>  
>> As editor, my feeling is we have no *clean* or *simple* solution
>> because we have to use “iss” to mean the issuer of the SET in order
>> to comply with JWT and because OIDC conflates assertion issuer with
>> subject issuer, it makes it difficult to uniquely identify a “sub”
>> value because some events want to use “iss” for 2 purposes (to
>> identify the event issuer vs. the subject issuer).
>>  
>> None of the solutions presented are actually easy to explain. So far,
>> I’ve sided with Mike and William because they feel it is close enough
>> and it was editorially lazy (say nothing). I am worried that this is
>> actually complex for developers who do not know the history of how
>> JWTs emerged.
>>  
>> Let’s look at the examples we already have. Notice that in the
>> current draft, there are 3 separate ways of expressing the subject of
>> an event….
>>  
>> Scenario 1, the event issuer and subject issuer are the same:
>>  
>>    {
>>       "iss": "https://server.example.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=aZmCu-T30ddM7EO5MTTcZLtFvxVBsTqvt157yHUeOIU&e=>",
>>       "sub": "248289761001",
>>       "aud": "s6BhdRkqt3",
>>       "iat": 1471566154,
>>       "jti": "bWJq",
>>       "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>>       "events": {
>>         "http://schemas.openid.net/event/backchannel-logout
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__schemas.openid.net_event_backchannel-2Dlogout&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=qmlNwMQZyc4wKMGYlcbHv4N_qYgxNWYhJxV9x_obkMQ&e=>":
>> {}
>>       }
>>    }
>>  
>> Scenario 2, a relying party is issuing an event, event iss and sub
>> iss are different and thus there are repeat iss values:
>>  
>>    {
>>      "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>>  
>>      "sub": "248289761001",
>>      "iat": 1458496025,
>>      "iss": "https://my.examplemed.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",
>>      "aud": [
>>        "https://rp.example.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__rp.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=gpNhu-LU43cxIyrYhVcrMto66IZz2Jxwa5lzPpxVTD0&e=>"
>>      ],
>>      "events": {
>>        "https://openid.net/heart/specs/consent.html
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__openid.net_heart_specs_consent.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=0Z-ohlyQps3JNPgGR0j_zY-sRZI274Y9zMivRDXjmis&e=>":{
>>          "iss":"https://connect.example.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__connect.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=KpM1_m5EiidPDJVV4EzmfBTYG6hneVcT8hymd-6p1BI&e=>",
>>          "consentUri":[
>>            "https://terms.examplemed.com/labdisclosure.html#Agree
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__terms.examplemed.com_labdisclosure.html-23Agree&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=AAdiJeFhv-D7NndiSyTUpmxuwaxrG64CU2JvbKF1lc0&e=>"
>>          ]
>>        }
>>      }
>>    }
>>  
>> Scenario  3:  sub is universally unique:
>>  
>>    {
>>      "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
>>      "iat": 1458496025,
>>      "iss": "https://scim.example.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__scim.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=LyBq6tEQAe7jo3Yewc_F77-CHuOYZwsa4UYyVPDCFpc&e=>",
>>      "aud": [
>>        "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__jhub.example.com_Feeds_98d52461fa5bbc879593b7754&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=mOuO83TTWdG12H5jGxLpWICeVgNxA5q5xMAegwYiPeg&e=>",
>>        "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__jhub.example.com_Feeds_5d7604516b1d08641d7676ee7&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=SgkQ6fsaS-Le8I4wi1GGygVQsEZLxoN8sZQS3NvgZis&e=>"
>>      ],
>>      "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__scim.example.com_Users_44f6142df96bd6ab61e7521d9&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=FiGG_pwSjXMTe-zrlpNBMrFityNSwQdBVfjvDFMV1QE&e=>",
>>      "events": {
>>        "urn:ietf:params:scim:event:passwordReset":
>>          { "id":"44f6142df96bd6ab61e7521d9"},
>>        "https://example.com/scim/event/passwordResetExt
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_scim_event_passwordResetExt&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=l9vO69P8yOSS_2Gd_1ya8bJyBLwhFj_fl3yZG9ovzXo&e=>":
>>          { "resetAttempts":5}
>>      }
>>    }
>>  
>> I believe the current argument is that profiling specs explains how
>> their events are to be parsed. This means for multi-event parsers,
>> subject is inconsistent and potentially not mappable.  The
>> BackChannel Logout event is currently structured for only the OP to
>> issue. However Oracle wants that to be bi-directional so that web
>> sites can notify the IDP/OP that the user has logged out of a
>> specific web site.  If that happens, BackChannel logout will have
>> methods 1 and 2 required.
>>  
>> Would it be possible for events to require that “sub” be globally
>> unique — e.g. expressed as a url.  For example, in order for
>> backchannel to be issued by an OP or an RP, it would be expressed
>> with sub as a URL ("sub": “https://server.example.com/248289761001
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_248289761001&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=5Rnz1dzOEoK27YDktq_HMGneutBpDod8-iAqU1CgizQ&e=>”,):
>>    {
>>       "iss": "https://www.exampleapp.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.exampleapp.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=KuoD7Qelh1vowEZDz-WSjpIwC7vlR410B8RPsdfQg20&e=>",
>>       "sub": “https://server.example.com/248289761001
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__server.example.com_248289761001&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=5Rnz1dzOEoK27YDktq_HMGneutBpDod8-iAqU1CgizQ&e=>",
>>       "aud": "s6BhdRkqt3",
>>       "iat": 1471566154,
>>       "jti": "bWJq",
>>       "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>>       "events": {
>>         "http://schemas.openid.net/event/backchannel-logout
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__schemas.openid.net_event_backchannel-2Dlogout&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=qmlNwMQZyc4wKMGYlcbHv4N_qYgxNWYhJxV9x_obkMQ&e=>":
>> {}
>>       }
>>  
>> At least this way iss is never duplicated and sub is always the
>> addressable subject of the event regardless of the type of event.
>>  That would enable all 3 cases to be expressed one way for all specs.
>>  That seems simple to me (at least from how I would define this in
>> the spec).  
>>  
>> I had thought Justin was advocating a 4th option which is to always
>> embed “sub” and “iss” in the event payload.  So you would end up with
>> something like:
>>    {
>>      "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>>      "iat": 1458496025,
>>     _ "iss": "https://my.examplemed.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",_
>>      "aud": [
>>        "https://rp.example.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__rp.example.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=gpNhu-LU43cxIyrYhVcrMto66IZz2Jxwa5lzPpxVTD0&e=>"
>>      ],
>>      "events": {
>>        "https://openid.net/heart/specs/consent.html
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__openid.net_heart_specs_consent.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=0Z-ohlyQps3JNPgGR0j_zY-sRZI274Y9zMivRDXjmis&e=>":{
>>         _ "sub": "248289761001",_
>> _         "iss":"https://my.examplemed.com
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__my.examplemed.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=ZkLctIH2dAoi4hhkPymZDQingbkQfHt9YgekAMKelaQ&e=>",_
>>          "consentUri":[
>>            "https://terms.examplemed.com/labdisclosure.html#Agree
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__terms.examplemed.com_labdisclosure.html-23Agree&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=AAdiJeFhv-D7NndiSyTUpmxuwaxrG64CU2JvbKF1lc0&e=>"
>>          ]
>>        }
>>      }
>>    }
>>  
>> Note that in the above example, “iss” would always be present even if
>> “iss” is the *same*.  The rule would be that the iss and sub are in
>> the payload and that addresses the subject of the event. The envelope
>> level is always reserved for event validation and addressing only.
>>  While some would argue this is ugly, I can see some merits as it is
>> at least consistent.
>>  
>>  
>> Phil
>>  
>> Oracle Corporation, Identity Cloud Services & Identity Standards
>> @independentid
>> www.independentid.com
>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=B_jjXc15tMFqi9Ef2x7fWuBKYckJ2pchgc61F80QAWA&e=>
>> [e-mail] <mailto:[e-mail]>
>>  
>>  
>>  
>>  
>>
>>  
>>
>>  
>>
>>     On Mar 7, 2017, at 7:26 AM, Justin Richer <[e-mail]
>>     <mailto:[e-mail]>> wrote:
>>      
>>     +1
>>      
>>     On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
>>
>>         On 03/06/2017 06:39 PM, Mike Jones wrote:
>>
>>             Justin, I suspect you didn’t see my earlier reply to
>>             Phil’s note that you also replied to, so I’m repeating it
>>             here and sending it to you directly.  (It wouldn’t be the
>>             first time that DMARC policies caused some of my
>>             contributions to be not received by some participants. :-( )
>>              
>>             Agreed that this is unclear.  Duplicating information in
>>             a protocol **always** introduces an unnecessary error
>>             case – the need to define how to handle the situation in
>>             which two pieces of information that are required to be
>>             identical are different.  Information in a SET should
>>             occur at most once.
>>              
>>
>>
>>         That seems a dangerous road to tread, as it requires care in
>>         defining "information" -- duplicating the same data strings
>>         at different levels of the hierarchy of a JSON object may
>>         very well not be duplicating information, due to the extra
>>         context provided by the hierarchy.  In my mind, it's not a
>>         clear case that you should never send the same name/value
>>         multiple times in different parts of an object, as sometimes
>>         it is good to keep the semantic separation clear.
>>
>>         -Ben
>>
>>      
>>
>>  
>> _______________________________________________
>> Id-event mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/id-event
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=sssDLkeEEBWNIXmTsdpw8TZ3tAJx-Job4p1unc7rOhM&m=OndKKucFPayCxClqGiVktItU3lmkVkSzQBxUvBmLEik&s=GvCU0sssYF2cnSpnUau9N2MD6u_C3mtzrBtqNOwmKi0&e=>
>
>
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event