Subject: [Id-event] Editorial discussion: Attributes or Claims

From: Phil Hunt <[email-masked]>
Date: Wed, 31 Aug 2016 11:20:19 -0700

For the next draft, I realized that draft 03 uses a mix of the terms “attribute” and “claims”.  In part this occured because the draft originally came out of SCIM and then we switched to using JWTs.

While the terms are used synonymously, it would probably be less confusing to readers to use one term or the other and to properly define its use. My feeling is that “attribute” fits better as we are saying a SET is a statement of fact from the perspective of the issuer.  The statement about attributes that are not in dispute (x was changed).  This is very different from an access token or an authentication assertion where there is a degree of confidence in the value.

For draft 04, I have revised the draft to consistently use “attributes” while providing an explanation/definition.  

I wanted to call your attention to this in advance and hopefully get some discussion.  I would like to make clear that we can switch to “claims” if people feel strongly that consistency with 7519 provided we can all agree to redefine the term “claim” as being factual in a SET.  I can see how people will view simplicity and consistency in different ways here.

In the end, I do not want to spend to much time on this as it doesn’t change SETs normatively. This is just editorial cleanliness and we should avoid too much bike shedding here.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

---

From: Nick Roy <[email-masked]>
Date: Wed, 31 Aug 2016 13:28:14 -0600

+1 to this change, too.

Nick

On 8/31/16 12:20 PM, Phil Hunt wrote:
> For the next draft, I realized that draft 03 uses a mix of the terms 
> “attribute” and “claims”.  In part this occured because the draft 
> originally came out of SCIM and then we switched to using JWTs.
>
> While the terms are used synonymously, it would probably be less 
> confusing to readers to use one term or the other and to properly 
> define its use. My feeling is that “attribute” fits better as we are 
> saying a SET is a statement of fact from the perspective of the 
> issuer.  The statement about attributes that are not in dispute (x was 
> changed).  This is very different from an access token or an 
> authentication assertion where there is a degree of confidence in the 
> value.
>
> For draft 04, I have revised the draft to consistently use 
> “attributes” while providing an explanation/definition.
>
> I wanted to call your attention to this in advance and hopefully get 
> some discussion.  I would like to make clear that we can switch to 
> “claims” if people feel strongly that consistency with 7519 provided 
> we can all agree to redefine the term “claim” as being factual in a 
> SET.  I can see how people will view simplicity and consistency in 
> different ways here.
>
> In the end, I do not want to spend to much time on this as it doesn’t 
> change SETs normatively. This is just editorial cleanliness and we 
> should avoid too much bike shedding here.
>
> Phil
>
> @independentid
> www.independentid.com <http://www.independentid.com>
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
>
>
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event

---

From: Mike Jones <[email-masked]>
Date: Wed, 31 Aug 2016 19:56:24 +0000

I would advocate using the term “claim”, since that’s consistent with other JWT usage.  For instance, note that https://tools.ietf.org/html/rfc7523 uses the term “claim” for this reason, even though the parallel spec using SAML https://tools.ietf.org/html/rfc7522 uses “attribute” to be consistent with SAML terminology usage.

A claim is exactly a statement being made by an issuer.  (It’s still up to the receiver of the JWT to decide what actions to take based on those statements by the issuer, based in part about what its relationship to the issuer is.)  So I don’t think there’s any terminology advantage of “assertion” over “claim”.

In the end, I think we’ll just confuse people by using “assertion” with JWTs because all other JWT specs that I know of use the term “claim”.  They’ll ask “why is a different term being used?” and there won’t be any substantive reason we can cite.

                                                       -- Mike

From: Id-event [mailto:[email-masked]] On Behalf Of Phil Hunt
Sent: Wednesday, August 31, 2016 11:20 AM
To: [email-masked]
Subject: [Id-event] Editorial discussion: Attributes or Claims

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>