[Txauth] acquiring claims (was Polymorphism (Was: JSON Schema?))

[Dick Hardt <[e-mail]>]

inline ...

On Thu, Jul 9, 2020 at 5:44 PM Justin Richer <[e-mail]> wrote:

> Yes, the core idea is to not have to parse an assertion to get back the
> core authentication information, which consists of an identifier (iss/sub
> pair in OIDC, but could be a number of things). Sometimes the client is
> going to want the rest of the identity information, but If the user’s
> logged into the client before, the client has likely cached that info and
> probably won’t need it, and sending it would be a violation of privacy
> principles.. The client would want the info pretty much just in these cases:
>
>  1. The client has never seen the user before.
>  2. The user’s information has been updated since the last time the client
> saw it.
>

Agreed


>
> Now for case (1), how would the client know if it wants to request the
> user’s profile info or not, since it doesn’t know who the user is?
>

But the client could know who the user is. The client may have used a
different AS to authenticate the user. The User may have self identified to
the client. The client may have a cookie saying who the user was and the
user said that was them. While the latter cases are really a strong hint,
they are likely right most of the time and can lead to a user experience
basde on that hint


> And the AS won’t know if client is going to want the profile info, since
> the AS won’t know if the client has the user’s info or not. Sure, the AS
> might have seen that client and that user combo previously, but it doesn’t
> know if the client needs an update.
>

The client can share with the AS the user it knows or thinks it is dealing
with, which could let the AS respond if the information was new. This could
be the case for an AS that is providing claims, but not authentication, and
could happen silently. The user would only interact if the user information
had changed, and the client wanted the updated information.


>
> And for (2), the client won’t know if the user’s info has been updated or
> not because it doesn’t know who the user is yet. If the AS can provide some
> time of updated stamp to the client, the client can pull the new info when
> it needs it.
>

See above.


>
> If you ignore both of these cases and put all the user information inline
> with the main request/response, you end up in a situation where the client
> always requests everything and the server always provides everything, since
> you can’t be sure you’re not in situation (1) or (2) ahead of time.
>

See above. There are a number of other states the client could be in.

For example, the client could be stateless about user information, so it
knows it is ALWAYS in state 1.


>
> This is really what I mean about the two-stage identity protocol.
>

I know what it is. Per above, GNAP lets us support a wider set of use
cases. Why limit ourselves to what OIDC supported?


> In the first stage, you push the bare minimum of what you need to get the
> user known to the client. In the second stage, the client uses its access
> token to call an API to get whatever else it needs to know about the user.
>

>From a privacy perspective in non-enterprise use cases, I think the user
should give consent to any updated personal information to a client. In
general, the client should not be able to get the latest information about
a user whenever it wants.

/Dick
ᐧ