Re: [Txauth] alternative charter writeup

[Justin Richer <[e-mail]>]

I think that’s exactly the reason — the case of getting information about the user directly from the TX endpoint is well established. People don’t want to make another round trip just to figure out who’s there, when a lot of time that’s the first thing they care about, and then the’d make the determination of whether to follow other APIs after that. 

So if I can send you a very basic set of authn info from the callback, like an identifier and VoT style login information, then you can figure out if you need to know more about that user or not. But these basic claims do get elevated to the same level as other returned artifacts from the transaction, like the access tokens.

 — Justin

> On Jan 16, 2020, at 2:12 PM, Richard Backman, Annabelle <[e-mail]> wrote:
> 
> The only reason I can think of to single out identity within the charter is if there is some work or feature that is within scope for the working group, but only for identity claims (e.g., returning identity claims from the transaction endpoint). Repeating a question I posed earlier, what is it about identity claims that make them worthy of special consideration?
> 
> – 
> Annabelle Richard Backman
> AWS Identity
> 
> 
> On 1/16/20, 8:51 AM, "Justin Richer" <[e-mail]> wrote:
> 
>    On Jan 16, 2020, at 11:15 AM, Torsten Lodderstedt <[e-mail]> wrote:
>> 
>> 
>> 
>>> Am 16.01.2020 um 16:45 schrieb Justin Richer <[e-mail]>:
>>> 
>>> - Approval of identity claims and multiple resources in a single interaction
>> 
>> This sounds a bit incomplete to me. I assume the user would approve „the attestation of identity claims“. I furthermore think the user would approve „access to multiple APIs“. I would prefer API over resource because it is more universal. For example, the protocol could also be used to create resources.
> 
>    Point taken, but this isn’t meant to be an exhaustive list of what it can do, merely the list of things we’re positive we want it to do. I also prefer “API” over “resource”, but concede that “resource” can be a writeable thing too. Even then I’m happy to tweak the language here. 
> 
>     — Justin
>