Subject: [Id-event] Single-event SET token draft proposal

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Fri, 1 Dec 2017 01:30:03 +0000

Hello secevent list,

I have submitted draft-backman-secevent-token<https://datatracker.ietf.org/doc/draft-backman-secevent-token/> an alternate proposal for the Security Event Token format, as an attempt to address the open issues around event subject identification and single-event versus multiple-event SETs. Here is a quick summary of the major differences between this draft and draft-ietf-secevent-token-03:

  1.  Replaces the “events” claim with an “event” claim whose value is a single JSON “event payload” object containing a handful of metadata claims along with whatever event claims the profiling specification defines.
  2.  Defines an “event.event_subject” claim whose value is a JSON object representing a Subject Identifier.
     *   Recommends the use of “event.event_subject” unless the subject is implicitly known or specified through the JWT “sub” claim.
  3.  Introduces “Subject Identifier”: a set of claims that when taken together identify the subject of an event.
     *   Defines the “email”, “phone_number”, and “iss_sub” Subject Identifier Types.
  4.  Defines the “Related Events” event type, which has an “events” claim that contains a list of events that “represent or express different aspects of the same event or state change.”
  5.  Recommends the use of Collision Resistant Names when extending existing events with additional claims.

I encourage everyone to read through this draft and shoot whatever holes you can in it. ☺

My proposal: https://datatracker.ietf.org/doc/draft-backman-secevent-token/
Currently adopted draft: https://datatracker.ietf.org/doc/draft-ietf-secevent-token/

--
Annabelle Richard Backman
Amazon – Identity Services