Subject: [OAUTH-WG] An access token claim to identify data processing purposes

From: Roberto Polli <[email-masked]>
Date: Mon, 4 Apr 2022 15:35:50 +0200

Hi folks,

I'm finding a standard way to express data processing purposes in access
token/requests.
E.g an access token request/response should provide an identifier linked to
the reason that motivates
a specific data processing.

The first idea is that this identifier is conveyed in a custom claim,
but maybe there's an existing claim/access token request parameter already.

If such a parameter does not exist, which is the procedure for registering
it?

Kind regards,
R:

---

From: Steinar Noem <[email-masked]>
Date: Mon, 4 Apr 2022 16:32:45 +0200

Maybe you’ll find the work on RAR and identity assurance in OIDF
interesting?
RAR could be used for indicating a “legitimate interest”, and IA could
cater for accountability.

man. 4. apr. 2022 kl. 15:36 skrev Roberto Polli <[email-masked]>:

> E.g an access token request/response should provide an identifier linked
> to the reason that motivates
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
-- 
Vennlig hilsen

Steinar Noem
Partner Udelt AS
Systemutvikler

| [email-masked] | [email-masked]  | +47 955 21 620 | www.udelt.no |

---

From: Roberto Polli <[email-masked]>
Date: Mon, 4 Apr 2022 18:02:27 +0200

Thanks Noem,

Il giorno lun 4 apr 2022 alle ore 16:32 Steinar Noem <[email-masked]> ha
scritto:
>>  I'm looking for a standard way to express data processing purposes in
access token/requests.
interesting?

You mean the authorization_details and verified_claims ?
Interesting! Is was wondering whether there was something more concise,
but I will investigate if that's viable for a machine-to-machine
interaction like the one
I'm working on.

Thanks again,
R:

---

From: Steinar Noem <[email-masked]>
Date: Mon, 4 Apr 2022 18:08:28 +0200

Ah, for machine-to-machine the eKYC/IA spec is not relevant - as it
requires an interactive session (an authenticated user).
But the Rich Authorization Spec (authorization_details) describes how to
express more information related to a grant, so that would be fitting I
would think. We use the structure for accountability purposes, legal basis
and legitimate interest - and reflect certain claims in the access token
(JWT).

man. 4. apr. 2022 kl. 18:02 skrev Roberto Polli <[email-masked]>:

> Thanks Noem,
>
> Il giorno lun 4 apr 2022 alle ore 16:32 Steinar Noem <[email-masked]>
> ha scritto:

-- 
Vennlig hilsen

Steinar Noem
Partner Udelt AS
Systemutvikler

---

From: Roberto Polli <[email-masked]>
Date: Mon, 4 Apr 2022 18:17:40 +0200

Hi N,

Il giorno lun 4 apr 2022 alle ore 18:08 Steinar Noem
<[email-masked]> ha scritto:
> Ah, for machine-to-machine the eKYC/IA spec is not relevant - as it requires an interactive session (an authenticated user).
Ok. Could that information be vouched by a third party though?

> But the Rich Authorization Spec (authorization_details) describes how to express more information related to a grant, so that would be fitting I would think.
> We use the structure for accountability purposes, legal basis and legitimate interest - and reflect certain claims in the access token (JWT).
If this is related to public sector API, it would be really
interesting to discuss that topic and see some examples!

Have a nice day,
R.

>> Il giorno lun 4 apr 2022 alle ore 16:32 Steinar Noem <[email-masked]> ha scritto:
>> >>  I'm looking for a standard way to express data processing purposes in access token/requests.
>> >>E.g an access token request/response should provide an identifier linked to the reason that motivates
>> > Maybe you’ll find the work on RAR and identity assurance in OIDF interesting?
>> > RAR could be used for indicating a “legitimate interest”, and IA could cater for accountability.
>>
>> but I will investigate if that's viable for a machine-to-machine interaction like the one
>> I'm working on.
>>
>> Thanks again,
>> R:
>>
>
>
> --
> Vennlig hilsen
>
> Steinar Noem
> Partner Udelt AS
> Systemutvikler
>