Subject: [Id-event] SET examples for a healthcare context

From: Sarah Squire <[email-masked]>
Date: Wed, 31 Aug 2016 11:02:31 -0700

Hi all,

I've been putting together some examples based on the idevent-token-03
draft. You can find them here:

https://github.com/id-event/examples

There are three examples of an idp-to-rp SET - consent, token revocation,
and userinfo update.

There are two examples of an rp-to-idp SET - parallel authentication and
suspected fraud.

This format seems workable for our use cases. Note that none of these
include or require "sub" at the top level.

Sarah

Sarah Squire
Engage Identity
http://engageidentity.com

---

From: Phil Hunt <[email-masked]>
Date: Wed, 31 Aug 2016 11:29:34 -0700

Sarah,

Your examples highlight some issues around “sub” that are still in a flux. For draft 04, the emerging consensus seems to be to use “sub” to be used at the top level as it is already defined as a JWT claim.  Yet for some systems, the problem is that “sub” is not a URI and without an “iss” is incomplete.  This becomes problematic then if “iss” of the event is not the “iss” of the “sub”.

Your examples actually show this - for example heart-parallel-auth.json

For now, I’m just taking the editorial position that “sub” in the envelope or “sub” in the payload is up to the profiling specification to decide.  That gives me some worry about inconsistency between specs, but I think it may not be that big a deal in practice since people will tend to worry about one family of events at a time in the context of a single subscriber.

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Aug 31, 2016, at 11:02 AM, Sarah Squire <[email-masked]> wrote:
> 
> Hi all,
> 
> I've been putting together some examples based on the idevent-token-03 draft. You can find them here:
> 
> https://github.com/id-event/examples <https://github.com/id-event/examples>
> 
> There are three examples of an idp-to-rp SET - consent, token revocation, and userinfo update.
> 
> There are two examples of an rp-to-idp SET - parallel authentication and suspected fraud.
> 
> This format seems workable for our use cases. Note that none of these include or require "sub" at the top level.
> 
> Sarah
> 
> Sarah Squire
> Engage Identity
> http://engageidentity.com <http://engageidentity.com/>_______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event

---

From: Justin Richer <[email-masked]>
Date: Thu, 1 Sep 2016 09:48:41 +0300

You can specify a recommended direction for the profiles. So, the sub in the event stack “SHOULD” have a certain set of semantics, for parallelism. I think it’s actually a good idea to provide that kind of guidance.

 — Justin

> On Aug 31, 2016, at 9:29 PM, Phil Hunt <[email-masked]> wrote:
> 
> Sarah,
> 
>> On Aug 31, 2016, at 11:02 AM, Sarah Squire <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi all,
>> 
>> [email-masked] <mailto:[email-masked]>
> _______________________________________________
> Id-event mailing list
> [email-masked]