Subject: [CDNi] URI Signing Logging Codes

From: Chris Lemmons <[email-masked]>
Date: Wed, 23 Jan 2019 12:05:25 -0700

It looks like the Logging Codes in §4.5 are a bit behind some other
recent changes. Some notes:

403 refers to "Regular Expression" enforcement, but it's possible a
different container was used. If this is to refer just to regexen,
that's fine, but then we'd need a code for mismatched other container.
I suspect this should just say, "cdniuc enforcement".

These claims can be used for enforcement, but don't have an associated
code (with examples):
  sub: The subject isn't authorized for content on the dCDN.
  aud: The token was presented to the wrong dCDN.
  jti: A token is reused.
  cdniv: An unsupported token version number is presented.
  cdnicrit: An unsupported extension is used.

Additionally, although the 500 code can be used for a malformed URI,
it's unclear what should be logged when the claim formulation is
unacceptable, for example, a negative cdnistd claim or a cdnistt
without a cdniets claim. In fact, it's not entirely clear from the
text whether a claim formulated like this MAY, MUST, or MUST NOT be
rejected.

And if a token is rejected for a reason not listed, presumably as a
result of an extension, what number should be logged? Should we have a
"catch-all"?

What if a token is invalid for multiple reasons? Which code takes precedence?