Re: [Jwt-reg-review] Request to register claim: permissions

Hi Eve,

I think a bit more revision work on the document is needed before this
request to register the 'permissions' JWT claim can be sent to IANA.

Section 5 kind of sort of implies the possible use of JWT in saying,
"Validate the RPT locally if it is self-contained" but otherwise JWT isn't
mentioned in the document at all other than the IANA request in Section
9.2. (which cites [OIDCCore] regarding JWT claim registration rather than
RFC 7519 that it should be - see https://tools.ietf.org/html/rf
c7800#section-6.1 for an example).  For that matter RFC 7519, which defines
JSON Web Token and established the claims registry, isn't even referenced
in the document.

Section 5.1.1
<https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
is about the 'permissions' parameter in the Token Introspection response.
While there are similarities in how they sometimes are used, the
introspection response parameters and JWT claims are distinct and different
things. Sec 5.1.1. can't be said to define a JWT claim. At the least, I
would expect some definition of the 'permissions' claim in JWT even if it
just cites the introspection response parameter and says it means the same
thing but is a claim in a self-contained JWT. I'm guessing that was more or
less the intent. But that's a lot of inferring and I believe a
specification and IANA registration need to be more explicit.

On Fri, Jun 16, 2017 at 6:41 PM, Eve Maler <eve.maler@forgerock.com> wrote:

> As required by RFC 7519 Section 10.1, the authors of the specification Federated
> Authorization for User-Managed Access (UMA) 2.0
> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html>  are
> requesting to register the following claim:
>
>    - permissions
>
> The claim definition appears in Section 5.1.1
> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
> The IANA request appears in Section 9.2
> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#rfc.section.9.2>
> .
>
> Thank you. We look forward to your response.
>
>
> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging
> Technology
> Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter:
> @xmlgrrl
>
> _______________________________________________
> Jwt-reg-review mailing list
> Jwt-reg-review@ietf.org
> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>
>

-- 
<https://www.pingidentity.com>[image: Ping Identity]
<https://www.pingidentity.com>
Brian Campbell
Distinguished Engineer
bcampbell@pingidentity.com
w: +1 720.317.2061
c: +1 303.918.9415
Connect with us: [image: Glassdoor logo]
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
logo] <https://twitter.com/pingidentity> [image: facebook logo]
<https://www.facebook.com/pingidentitypage> [image: youtube logo]
<https://www.youtube.com/user/PingIdentityTV> [image: Google+ logo]
<https://plus.google.com/u/0/114266977739397708540> [image: Blog logo]
<https://www.pingidentity.com/en/blog.html>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*