Re: [Jwt-reg-review] Request to register claim: permissions

Hi Brian-- The Work Group has discussed this, and decided to rescind our
registration request. Thanks very much for your time and feedback. We may
come back at a later date with something more fully considered.

*Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology
Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

On Wed, Jun 28, 2017 at 1:24 PM, Brian Campbell <bcampbell@pingidentity.com>
wrote:

> Hi Eve,
>
> I think a bit more revision work on the document is needed before this
> request to register the 'permissions' JWT claim can be sent to IANA.
>
> Section 5 kind of sort of implies the possible use of JWT in saying,
> "Validate the RPT locally if it is self-contained" but otherwise JWT isn't
> mentioned in the document at all other than the IANA request in Section
> 9.2. (which cites [OIDCCore] regarding JWT claim registration rather than
> RFC 7519 that it should be - see https://tools.ietf.org/html/rf
> c7800#section-6.1 for an example).  For that matter RFC 7519, which
> defines JSON Web Token and established the claims registry, isn't even
> referenced in the document.
>
> Section 5.1.1
> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
> is about the 'permissions' parameter in the Token Introspection response.
> While there are similarities in how they sometimes are used, the
> introspection response parameters and JWT claims are distinct and different
> things. Sec 5.1.1. can't be said to define a JWT claim. At the least, I
> would expect some definition of the 'permissions' claim in JWT even if it
> just cites the introspection response parameter and says it means the same
> thing but is a claim in a self-contained JWT. I'm guessing that was more or
> less the intent. But that's a lot of inferring and I believe a
> specification and IANA registration need to be more explicit.
>
>
>
>
>
> On Fri, Jun 16, 2017 at 6:41 PM, Eve Maler <eve.maler@forgerock.com>
> wrote:
>
>> As required by RFC 7519 Section 10.1, the authors of the specification Federated
>> Authorization for User-Managed Access (UMA) 2.0
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html>  are
>> requesting to register the following claim:
>>
>>    - permissions
>>
>> The claim definition appears in Section 5.1.1
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
>> The IANA request appears in Section 9.2
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#rfc.section.9.2>
>> .
>>
>> Thank you. We look forward to your response.
>>
>>
>> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging
>> Technology
>> Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter:
>> @xmlgrrl
>>
>> _______________________________________________
>> Jwt-reg-review mailing list
>> Jwt-reg-review@ietf.org
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>
>>
>
>
> --
> <https://www.pingidentity.com>[image: Ping Identity]
> <https://www.pingidentity.com>
> Brian Campbell
> Distinguished Engineer
> bcampbell@pingidentity.com
> w: +1 720.317.2061 <(720)%20317-2061>
> c: +1 303.918.9415 <(303)%20918-9415>
> Connect with us: [image: Glassdoor logo]
> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm> [image:
> LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
> logo] <https://twitter.com/pingidentity> [image: facebook logo]
> <https://www.facebook.com/pingidentitypage> [image: youtube logo]
> <https://www.youtube.com/user/PingIdentityTV> [image: Google+ logo]
> <https://plus.google.com/u/0/114266977739397708540> [image: Blog logo]
> <https://www.pingidentity.com/en/blog.html>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*