Re: [stir] Proposed JWT Constraints Syntax

[Russ Housley <[e-mail]>]

Based on the discussion in the room, the claim values should allow UTF8String, not just IA5String.

That change would result in:


JWTClaimConstraints ::= SEQUENCE {
  mustInclude [0] JWTClaimNames OPTIONAL,
     -- The listed claim names MUST appear in the PASSporT in addition to iat, orig, dest
     -- If absent, iat, orig, dest MUST appear in the PASSporT
  permittedValues [1] JWTClaimPermittedValuesList OPTIONAL }
     -- If the claim name is present, the claim MUST contain one of the listed values
   ( WITH COMPONENTS { ..., mustInclude PRESENT }
  | WITH COMPONENTS { ..., permittedValues PRESENT } )

JWTClaimPermittedValuesList SEQUENCE SIZE (1..MAX) OF JWTClaimPermittedValues
JWTClaimPermittedValues ::= SEQUENCE {
   claim  JWTClaimName,
   permitted  SEQUENCE SIZE (1..MAX) OF UTF8String }

JWTClaimNames ::= SEQUENCE SIZE (1..MAX) OF JWTClaimName
JWTClaimName ::= IA5String