Subject: [Id-event] draft-hunt-idevent-token -06

From: Jim Schaad <[email-masked]>
Date: Mon, 21 Nov 2016 10:54:14 -0800

Somebody mentioned this group to me last week at the F2F meeting in the
context of work being done in a different group.  I therefore did a fast
read on this draft and there are two issues that I want to highlight as
being of major concern to me.

1.  Section 3.5 gives advice on how to distinguish a SET from a JWT.  While
I think that building on the JWT infrastructure can make sense, the use of
random rules to try and do distinguishing between different types does not
make any sense to me.  I would feel much more comfortable with a single
fixed way of being able to distinguish between them.  It seems to me to make
far more sense to use either the typ or ctyp fields in the header to make
this distinction.  One could either do 'typ'='SET' or 'typ=JWT' and
ctyp='SET' and it would be totally unambiguous.

2.  The way that qualifiers are setup in this document looks to be a
potential registration nightmare.   The fact that any qualifier might have
data stated as a claim means that people might want to use a registered
value rather than a full url to make the message shorter.  This is even more
significant if one is looking at moving the world of CWT at some point in
the future.

It makes more sense to me to say that the event array has a string as the
first element and then the subsequent elements be objects which describe the
qualifiers.  Thus you might get:

"events":[
    "urn:ietf:params:scim:event:passwordReset",
    {"name":"https://example.com/scim/event/passwordResetExt",
     "resetAttempts":5
    }
]

One can then play games with what goes into the name field to shorten things
if one wishes.  For example the above could be "./passwordResetExt" if the
qualifier is defined by the URN as opposed to being defined locally by
example.com.  

Jim

---

From: Phil Hunt <[email-masked]>
Date: Mon, 21 Nov 2016 11:36:03 -0800

Jim,

Thanks for the feedback! Comments inline below.  

Phil

@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Nov 21, 2016, at 10:54 AM, Jim Schaad <[email-masked]> wrote:
> 

This was discussed at some length.  See:
https://www.ietf.org/mail-archive/web/id-event/current/msg00001.html <https://www.ietf.org/mail-archive/web/id-event/current/msg00001.html>

> significant if one is looking at moving the world of CWT at some point in

Early on the authors discussed requiring events to be registered with IANA, in part to potentially reconcile duplicate events.

There was a feeling that events may be negotiated between specific parties or used internally. So in draft 01, we switched from URNs to URIs for the value of events.

The group should feel free to re-open this discussion if there is a preference to register events.  I note that just because the spec might say events should be registered doesn’t have to mean that internal uses are registered to work in reality.

>    {"name":"https://example.com/scim/event/passwordResetExt",

During the IETF97 SECEVENTS meeting, it was proposed to actually do this. I’m amending the proposed draft (version 07) now.

We also discussed this informally and a summary is available here where a number of alternatives were proposed (the formal session preferred version 3:
https://www.ietf.org/mail-archive/web/id-event/current/msg00273.html

> 
> Jim
> 
> 
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event

---

From: Jim Schaad <[email-masked]>
Date: Tue, 22 Nov 2016 00:48:58 -0800

From: Phil Hunt [mailto:[email-masked]] 
Sent: Monday, November 21, 2016 11:36 AM
To: Jim Schaad <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: [Id-event] draft-hunt-idevent-token -06

Jim,

Phil

@independentid

www.independentid.com <http://www.independentid.com> 

[email-masked] <mailto:[email-masked]> 

 

On Nov 21, 2016, at 10:54 AM, Jim Schaad <[email-masked] <mailto:[email-masked]> > wrote:

https://www.ietf.org/mail-archive/web/id-event/current/msg00001.html

[JLS] Please note that my issue had nothing to do with the event itself, but with qualifiers.  (I also note that events are URNs so your sentence above may be reversed.)

Jim

"events":[

One can then play games with what goes into the name field to shorten things
if one wishes.  For example the above could be "./passwordResetExt" if the
qualifier is defined by the URN as opposed to being defined locally by
example.com <http://example.com> .  

Jim

_______________________________________________
Id-event mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/id-event