Re: [GNAP] DID as sub_id or assertion?

[Justin Richer <[e-mail]>]

> 
> > Just a quick comment: an assertion in option 2 is not "the fact the identifier is resolvable to cryptographic material that can be used to validate cryptographic assertions". It is merely a statement by the AS that "the subject corresponding to the reference has a DID" ("has" is the assertion here). 
> 
> Yes I understand to drill down on this more though couldn't the entire request made by the client to the AS also be considered to be an assertion? Therefore the "sub_ids" request element is an assertion by the client about who it believes the subject to be identified as? If this is true then to me the "assertions" request element is there for assertions that parties other than the client are making about the subject (e.g an id_token).
>  

That’s my reading of it, on a wider sense. The assertions in the “assertions” part of the request have been given to the client by some other party, and the client is passing them along to the AS to say “this is who I believe is here right now”. It’s up to the AS to decide if it trusts that. Now around that, the client itself is making a larger statement to the AS and signed with the client instance key, so in a way the request is a kind of assertion. (it’s not really a separable unit of data so I wouldn’t go quite that far, when you drill into it.) But yes, in that context the “sub_ids” and “assertions” are both elements in the “assertion” the client instance is making to the AS about who’s there.

 — Justin