Re: [Txauth] Claims [was: - Dictionary]

Tom Jones <> Mon, 27 July 2020 03:44 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2C0CB3A166B for <>; Sun, 26 Jul 2020 20:44:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id AeRqAEsyPWhW for <>; Sun, 26 Jul 2020 20:44:56 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 768433A1669 for <>; Sun, 26 Jul 2020 20:44:56 -0700 (PDT)
Received: by with SMTP id r21so786209ota.10 for <>; Sun, 26 Jul 2020 20:44:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uYDW5PAeC6l+QxxLie+XNTD4Uls4n1ixNK+OCpS2xus=; b=hDeDnDAuJmizg9hQJg8m3U6XvaWCet5JtJggF5Lu9maGmL5hyA3J9/WAVKuIBkvwOU 4RGNHlzV+jdnzUJUPHcxxSkMFY2b1ZbbruX8mp+njnjlAw8EqW+axby++OxF62c2qX25 ODF/crmGmSTNUktetp3z4wLKGUH3ejPDBKq0EHRzr6fbzix+VJFo4q7mmeqVcvDZCFyA +vO3537Rq/V5fE7RS8ze+t+OsF7wYZ2MT5JArQIdCZwn7RO/6HbruH583BtIeB/+vYqA 5P2bFwpfXRVUzg9y/inbmE8TbWb54TTtSfi/RHPiCH6adpKhifw8aFY67y3XzhTy/VCV bphg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uYDW5PAeC6l+QxxLie+XNTD4Uls4n1ixNK+OCpS2xus=; b=rha01DfmBr0HGqL477Xtugs7PyQzmsrZeESRwoYD3ohC5VFvwXTD+9yogqNWWiLuwv Vjcl346Ou6pdrlKGeQBsIrVQ/pi5Ji6I/u5n9CwZQgqZBjcrwlda4YYIC4SRDm1OmSmx VYnRnhHHLu+1GZ7ESLOyYdX1hrXroJlaEG9+LSFy3Hy5RF9lsJAJuMBM41ofH9Hmf0EA /nz1eBuyO80wkhKA7bQXdYQLnz20TVq/PdvpguTBOJwOHEYVtOLjDdLjV0mdm9TCV9cQ J5rQn0/yOgN3+xCtS41RP6aG3jQ6Y7vXnbrBzukDrPYV8eF+zaYGO+S+8NeE9oFvWTya ovNQ==
X-Gm-Message-State: AOAM530y7mfTu+7NAA2vVu6UDlLhzNY868CfiNP4AijjY2dj7B8d5q2L hObdxnMYhgwa9DWAUliDQ1V4a8u2v5PL9FOf+pc=
X-Google-Smtp-Source: ABdhPJxNmVqGTfS5O1zmff9PYZ9yAR46KH0r6t9QQ+ydW5TAlabea3QKgVcNgiHNf+STWvBwwAMmCeDFayHj3sSP+U4=
X-Received: by 2002:a9d:66ca:: with SMTP id t10mr18023175otm.358.1595821495565; Sun, 26 Jul 2020 20:44:55 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: Tom Jones <>
Date: Sun, 26 Jul 2020 20:44:44 -0700
Message-ID: <>
To: Justin Richer <>
Cc: Francis Pouatcha <>, Dick Hardt <>, txauth gnap <>, Denis <>
Content-Type: multipart/alternative; boundary="0000000000005e3f7005ab64257e"
Archived-At: <>
Subject: Re: [Txauth] Claims [was: - Dictionary]
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 27 Jul 2020 03:44:59 -0000

yeah. - one thought
let's look at a token issued by a user - so here's a guess.
1, a claim is a statement made about themself by the user (or the RO when
that is different.)
2. a grant is an authz for the client to acquire data about (inter alia)
data about the user.
Peace ..tom

On Fri, Jul 24, 2020 at 5:58 AM Justin Richer <> wrote:

> I want to focus on one aspect here:
>> A Claim is a well understood term in the field. We should use it. It is
>> still a Claim if it comes directly from the GS or from an RS.
> I do not understand why a Resource release by an RS shall be h to as a
> claim, even if the content of the Resource is an assertion. It will lead to
> confusion. If we limit claims to information GS releases into Token, User
> Info, and other objects it returns, this will help separate
> responsibilities between GS and RS. As soon as RS services and information,
> this is called a Resource, no matter the nature of the content of that
> information.
> This is exactly why I don’t think we should use “claim” in the way that
> we’re using it. Yes, a “claim” could come back through an RS — but in the
> context of GNAP, that makes it a resource. So we need a different word for
> data coming back directly from the AS to the client. Sometimes it’s going
> to be about the user, and that’s what we’re going to focus on here, but
> since you can also get information about the user from a resource we can’t
> just call it a “claim”. I think this has been at the heart of a lot of
> confusion in recent threads, as well as confusion about the scope of the
> inclusion of identity in the GNAP protocol.
> So let’s let “claim” mean what it already does, and let’s find a way to
> differentiate between when an item, claim or otherwise,  comes as part of a
> resource and when it comes back directly. This is an important
> differentiating feature for GNAP.
> Some straw man ideas, none of which I’m particularly in love with:
>  - direct data
>  - properties
>  - details
>  - statements
> The important thing here is that it’s not necessarily :about: the RO, and
> that it is :not: in a resource.
> Any other thoughts?
>  — Justin