Subject: [Id-event] Use of "exp" - recommend SHOULD NOT be used

From: Phil Hunt <[email-masked]>
Date: Wed, 31 Aug 2016 11:10:37 -0700

I had an offline email discussion with Mike Jones about “exp”. I thought I should share with the broader group.

We discussed if “exp” should have any meaning in a SET.  When you look at access tokens there are 3 things it is being used for:

1. Validation: is the token valid (not valid after exp)
2. Sessions:  the token is not valid when the assertion expires

A SET however is a statement of a fact at a point in time.  “Token WAS revoked”. One could say it is permanent and cannot expire since the fact will not change.  While we may not want to rule “exp" out, it does feel like the use of it should be avoided.

Any opinions here?

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

---

From: Nick Roy <[email-masked]>
Date: Wed, 31 Aug 2016 13:26:59 -0600

+1 to your assessment of the situation

Nick

On 8/31/16 12:10 PM, Phil Hunt wrote:
> I had an offline email discussion with Mike Jones about “exp”. I 
> thought I should share with the broader group.
>
> We discussed if “exp” should have any meaning in a SET.  When you look 
> at access tokens there are 3 things it is being used for:
>
> A SET however is a statement of a fact at a point in time.  “Token WAS 
> revoked”. One could say it is permanent and cannot expire since the 
> fact will not change.  While we may not want to rule “exp" out, it 
> does feel like the use of it should be avoided.
>
> Any opinions here?
>
> Phil
>
> @independentid
> www.independentid.com <http://www.independentid.com>
> [email-masked] <mailto:[email-masked]>
>
>
>
>
>
>
>
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event

---

From: Mike Jones <[email-masked]>
Date: Wed, 31 Aug 2016 19:48:29 +0000

I'm fine with making a non-normative rationale statement that "exp" isn't included in the set of recommended claims for the reasons Phil stated, as long as the text doesn't try to preclude some kinds of events from using it.

                                                       -- Mike

From: Id-event [mailto:[email-masked]] On Behalf Of Nick Roy
Sent: Wednesday, August 31, 2016 12:27 PM
To: [email-masked]
Subject: Re: [Id-event] Use of "exp" - recommend SHOULD NOT be used

Nick
On 8/31/16 12:10 PM, Phil Hunt wrote:
I had an offline email discussion with Mike Jones about "exp". I thought I should share with the broader group.

We discussed if "exp" should have any meaning in a SET.  When you look at access tokens there are 3 things it is being used for:

A SET however is a statement of a fact at a point in time.  "Token WAS revoked". One could say it is permanent and cannot expire since the fact will not change.  While we may not want to rule "exp" out, it does feel like the use of it should be avoided.

Any opinions here?

Phil

@independentid
www.independentid.com<http://www.independentid.com>
[email-masked]<mailto:[email-masked]>

Id-event mailing list

[email-masked]<mailto:[email-masked]>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 31 Aug 2016 13:30:27 -0700

I had wondered if events might reflect a temporary state change that expires. I would not preclude it, but inquire if in such cases an access token assertion is more appropriate rather than an event?

Phil

> On Aug 31, 2016, at 12:48 PM, Mike Jones <[email-masked]> wrote:
> 
> I’m fine with making a non-normative rationale statement that “exp” isn’t included in the set of recommended claims for the reasons Phil stated, as long as the text doesn’t try to preclude some kinds of events from using it.
>  
>                                                        -- Mike
>  
> www.independentid.com
> [email-masked]

---

From: Justin Richer <[email-masked]>
Date: Thu, 1 Sep 2016 09:50:18 +0300

Events should be able to use it just fine, but “exp” in the envelope doesn’t make a lot of sense in the SET context.

 — Justin

> On Aug 31, 2016, at 11:30 PM, Phil Hunt (IDM) <[email-masked]> wrote:
> 
> On Aug 31, 2016, at 12:48 PM, Mike Jones <[email-masked] <mailto:[email-masked]>> wrote:
> 
>>   <>
>> From: Id-event [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Nick Roy
>> To: [email-masked] <mailto:[email-masked]>
>> www.independentid.com <http://www.independentid.com/>
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event>
>>  
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event>
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event>