Re: [Jwt-reg-review] Request to register claim: permissions

Thanks for the update, Eve.

On Mon, Jul 24, 2017 at 2:01 AM, Eve Maler <eve.maler@forgerock.com> wrote:

> Hi Brian-- The Work Group has discussed this, and decided to rescind our
> registration request. Thanks very much for your time and feedback. We may
> come back at a later date with something more fully considered.
>
>
> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging
> Technology
> Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter:
> @xmlgrrl
>
> On Wed, Jun 28, 2017 at 1:24 PM, Brian Campbell <
> bcampbell@pingidentity.com> wrote:
>
>> Hi Eve,
>>
>> I think a bit more revision work on the document is needed before this
>> request to register the 'permissions' JWT claim can be sent to IANA.
>>
>> Section 5 kind of sort of implies the possible use of JWT in saying,
>> "Validate the RPT locally if it is self-contained" but otherwise JWT isn't
>> mentioned in the document at all other than the IANA request in Section
>> 9.2. (which cites [OIDCCore] regarding JWT claim registration rather than
>> RFC 7519 that it should be - see https://tools.ietf.org/html/rf
>> c7800#section-6.1 for an example).  For that matter RFC 7519, which
>> defines JSON Web Token and established the claims registry, isn't even
>> referenced in the document.
>>
>> Section 5.1.1
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
>> is about the 'permissions' parameter in the Token Introspection response.
>> While there are similarities in how they sometimes are used, the
>> introspection response parameters and JWT claims are distinct and different
>> things. Sec 5.1.1. can't be said to define a JWT claim. At the least, I
>> would expect some definition of the 'permissions' claim in JWT even if it
>> just cites the introspection response parameter and says it means the same
>> thing but is a claim in a self-contained JWT. I'm guessing that was more or
>> less the intent. But that's a lot of inferring and I believe a
>> specification and IANA registration need to be more explicit.
>>
>>
>>
>>
>>
>> On Fri, Jun 16, 2017 at 6:41 PM, Eve Maler <eve.maler@forgerock.com>
>> wrote:
>>
>>> As required by RFC 7519 Section 10.1, the authors of the specification Federated
>>> Authorization for User-Managed Access (UMA) 2.0
>>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html>  are
>>> requesting to register the following claim:
>>>
>>>    - permissions
>>>
>>> The claim definition appears in Section 5.1.1
>>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
>>> The IANA request appears in Section 9.2
>>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#rfc.section.9.2>
>>> .
>>>
>>> Thank you. We look forward to your response.
>>>
>>>
>>> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging
>>> Technology
>>> Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter:
>>> @xmlgrrl
>>>
>>> _______________________________________________
>>> Jwt-reg-review mailing list
>>> Jwt-reg-review@ietf.org
>>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>>
>>>
>>
>>
>> --
>> <https://www.pingidentity.com>[image: Ping Identity]
>> <https://www.pingidentity.com>
>> Brian Campbell
>> Distinguished Engineer
>> bcampbell@pingidentity.com
>> w: +1 720.317.2061 <(720)%20317-2061>
>> c: +1 303.918.9415 <(303)%20918-9415>
>> Connect with us: [image: Glassdoor logo]
>> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm> [image:
>> LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
>> logo] <https://twitter.com/pingidentity> [image: facebook logo]
>> <https://www.facebook.com/pingidentitypage> [image: youtube logo]
>> <https://www.youtube.com/user/PingIdentityTV> [image: Google+ logo]
>> <https://plus.google.com/u/0/114266977739397708540> [image: Blog logo]
>> <https://www.pingidentity.com/en/blog.html>
>>
>> *CONFIDENTIALITY NOTICE: This email may contain confidential and
>> privileged material for the sole use of the intended recipient(s). Any
>> review, use, distribution or disclosure by others is strictly prohibited.
>> If you have received this communication in error, please notify the sender
>> immediately by e-mail and delete the message and any file attachments from
>> your computer. Thank you.*
>
>
>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*