Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

[Anthony Nadalin <[e-mail]>]

Mike, claims are in doubt thus they have to be verified thus they don’t carry the proof

From: Mike Jones
Sent: Saturday, December 29, 2012 11:54 PM
To: Nat Sakimura; Anthony Nadalin
Cc: David Chadwick; IETF oauth WG
Subject: RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

The problem with the X.1252 definition is it unnecessarily adds the “without being able to give proof” comment.  That will distract the reader immediately.  The current “a piece of information asserted about a subject” definition is just as accurate as the X.1252 and doesn’t send readers down a mental rathole.

We can add an informative reference to X.1252 if you like, but I really think readability and simplicity are more important in this kind of a spec than reusing overly technical and off-putting ISO definitions.

About the terminology ordering, the current order is intended to be what I think you would call a reverse dependency chain – what I would call a top-down ordering.  It’s that way so that the JSON Web Token definition is first.  Then, as that definition needs other definitions, they immediately follow.  This is intended increase readability, by presenting concepts in a top-down manner.  By comparison, bottom-up ordering makes readers wade through a sea of other terms before getting to the one they really cared about.

If you want to reorder the terms to make sure they’re in the best top-down order possible, that would be useful.  (If you decide to do that, I’d also look at the terminology ordering in JWS, JWE, and JWK, as we should be as consistent as possible across the specifications.

                                                            -- Mike

From: Nat Sakimura [mailto:[e-mail]]
Sent: Saturday, December 29, 2012 8:04 PM
To: Anthony Nadalin
Cc: David Chadwick; Mike Jones; IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

Tony,

So do you agree with the following definition in -06? Or prefer X.1252 definition?


Claim  A piece of information asserted about a subject.  Here, Claims

      are represented name/value pairs, consisting of a Claim Name and a

      Claim Value.

Mike:

Regarding the ordering of the terms in terminology, you should either use the dependency chain or alphabetic order. (Former is more desirable in my point of view.) However, as it stands, it is none of those. For example, the term "claim" appears in the definition of JWT, which is the first term in the terminology, without having been defined. If you do not mind, I will reorder them and send it to you.

Nat

On Sun, Dec 30, 2012 at 9:28 AM, Anthony Nadalin <[e-mail]<mailto:[e-mail]>> wrote:
By definition a claim is always in doubt thus it would not call it a credential until it is verified

-----Original Message-----
From: [e-mail]<mailto:[e-mail]> [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of David Chadwick
Sent: Saturday, December 29, 2012 1:42 AM
To: Mike Jones
Cc: IETF oauth WG
Subject: Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05

If a claim provides proof then I would call it a credential not a claim

David

On 29/12/2012 01:11, Mike Jones wrote:
> I found the X.1252 definition.  It is:
>
> *6.18 claim *[b-OED]: To state as being the case, without being able
> to give proof.
>
> That seems both a bit vague, and actually incorrect, as the JWT may
> include proof of the veracity of the claim.  Please see the updated
> JWT draft for a hopefully more useful “Claim” definition.
>
>                                                              Best
> wishes,
>
>                                                              -- Mike
>
> *From:*Mike Jones
> *Sent:* Sunday, December 23, 2012 1:03 PM
> *To:* Jeff Hodges; Nat Sakimura
> *Cc:* IETF oauth WG
> *Subject:* RE: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05
>
> What is the X.1252 definition?
>
> -- Mike
>
> *From:* Nat Sakimura
> *Sent:* ‎December‎ ‎23‎, ‎2012 ‎10‎:‎09‎ ‎AM
> *To:* =JeffH
> *CC:* Mike Jones, IETF oauth WG
> *Subject:* Re: [OAUTH-WG] review: draft-ietf-oauth-json-web-token-05
>
> Re definition of 'claim', as JWT is supposed to be generic, it may be
> better to go with the definition of X.1252 rather than OIDC.
>
> =nat via iPhone
>
> Dec 24, 2012 2:42、=JeffH <[e-mail]<mailto:[e-mail]>
> <mailto:[e-mail]<mailto:[e-mail]>>> のメッセージ:
>
>>
>> > Thanks for the replies, Jeff.  They make sense.  Particularly,
>> > thanks for the "JSON Text Object" suggestion.
>>
>> welcome, glad they made some sense.
>>
>> similarly, if one employs JSON arrays, I'd define a "JSON text array".
>>
>>
>> > For the "claims" definition, I'm actually prone to go with
>> >definitions based  on those in
>> >http://openid.net/specs/openid-connect-messages-1_0-13.html#terminol
>> >ogy-
>> > specifically:
>> >
>> > Claim
>> > A piece of information about an Entity that a Claims Provider
>> > asserts about that Entity.
>> > Claims Provider
>> > A system or service that can return Claims about an Entity.
>> > End-User
>> > A human user of a system or service.
>> > Entity
>> > Something that has a separate and distinct existence and that can
>> > be identified in context. An End-User is one example of an Entity.
>>
>> well, it seems to me, given the manner in which the JWT spec is
>> written, one can make the case that JWT claims in general aren't
>> necessarily about an Entity (as the latter term is used in the
>> context of the OpenID Connect specs), rather they're in general
>> simply assertions about something(s). this is because all pre-defined
> JWT claim types are optional and all JWT semantics are left up to
> specs that profile (aka re-use) the JWT spec.
>>
>> HTH,
>>
>> =JeffH
>>
>> _______________________________________________
>> OAuth mailing list
>>[e-mail]<mailto:[e-mail]> <mailto:[e-mail]<mailto:[e-mail]>>
>>https://www.ietf.org/mailman/listinfo/oauth
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]<mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/oauth
>
_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/oauth



--
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en