Re: [Txauth] Polymorphism (Was: JSON Schema?)

[Justin Richer <[e-mail]>]

I once felt that way, too, and the first few iterations of XYZ did not use polymorphism. But I found, through hands-on experience, that it solves many more problems than it creates. I think that JWT didn’t quite do it because there was one limited place in the spec that used the feature — it was the exception, not a core part of the data model. And, JWT implementations that don’t expect an array in “aud” aren’t compliant, after all.

This is obviously an implementation detail for the WG to debate, and I think polymorphism should be one of the tools in consideration from the start. 

 — Justin

> On Jul 6, 2020, at 4:41 PM, Dick Hardt <[e-mail]> wrote:
> 
> 
> Responding to Justin's polymorphism comments ... 
> 
> On Mon, Jul 6, 2020 at 12:54 PM Justin Richer <[e-mail] <mailto:[e-mail]>> wrote:
> Polymorphism in the protocol is an important part of the XYZ proposal’s design, and as a feature it directly addresses a number of the items you found when doing your XAuth implementation, like parsing OAuth scopes and dealing with the authorization/authorizations mutually-exclusive oddness that you mentioned. I strongly believe that GNAP should make use of a polymorphic protocol structure for these and other reasons. Polymorphism is a built-in feature of the JSON data model, and it’s also fully possible to support under CBOR and other data serialization languages. Even JWT most famously uses polymorphism for the “aud” field, which can be a string or an array of strings depending on context, all with clear semantics.
> 
>  I strongly disagree with "GNAP should make use of a polymorphic protocol structure"
> 
> We should use it only if we really need it, and it makes implementations simpler. I personally don't think it accomplished that in JWT with the audience. I would bet there is a fair amount of code that does not check if the 'aud' property is an array, it just assumes it is a string.
> 
> wrt. my authorization / authorizations oddness, polymorphism would not solve it as the contents of both authorization / authorizations in XAuth are objects. 
> 
> /Dick
>