Re: [Txauth] WG Review: Grant Negotiation and Authorization Protocol (gnap)

[Mike Varley <[e-mail]>]

Hello Denis, all, I just wanted to jump in on this point below:

From: Txauth <[e-mail]> on behalf of Denis <[e-mail]>
Date: Monday, June 29, 2020 at 3:14 AM


Any trust relationship may be described using the following construction:  entity A trusts entity B for some action C.
If you have in mind additional trust relationships, would you be able to express them using this construction ?
Maybe you also have in mind some relationships that do not imply a form of trust ?



There is a proxy/broker model which sort of is described by the above, but I’d like to call out below.

There are cases where A trusts Z and  B trusts Z, but A and B do not know/trust each other directly, and Z is Not the AS (but there is a trust relationship between Z and the AS – this allows for more than one AS in the trust framework). In order for A and B to interact, the AS will act as a ‘locator’ service and subject-representative, but any associated access tokens the AS generate will require assurances from Z that the participants in the transaction are legitimate entities in the transaction.

Here is a for example: A is a rental car company, B is a DMV. The AS is a personal digital identity management service (*cough* wallet *cough*) that interacts with the license holder/Renter. A, B, and AS have a trust relationship and defined role in an organization Z. When the Renter wishes to provide his eligibility to drive to A, the AS must provide:

  1.  Evidence to A from Z that B is a qualified DMV (permitted to provide the required info).
  2.  Evidence to B from Z that A is a qualified Rental Car Company (permitted to collect the required into).
  3.  Evidence to both A and B from Z that the AS is a trusted subject representative.
  4.  A route for A and B to communicate with each other with all these access permissions.

Note in this model the AS can also be a trusted participant in another Z+1 trust framework.

I see GNAP as an opportunity to support the above model with flexible user agents, AS, discovery, token structures and crypto.

Thanks,

MV

This email and any attachments are for the sole use of the intended recipients and may be privileged, confidential or otherwise exempt from disclosure under law. Any distribution, printing or other use by anyone other than the intended recipient is prohibited. If you are not an intended recipient, please contact the sender immediately, and permanently delete this email and its attachments.