Subject: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli)

From: Tim Cappalli <[email-masked]>
Date: Mon, 13 Jul 2020 17:37:10 +0000

Sorry for the delay, I sent this last week but to the -bounces address by accident.

Here’s my feedback:

3.
    There are definitely use cases for locally significant subject identifier types between two parties (example: first party platforms). The current text mandates registration with IANA. There should be flexibility to use internal/private/local subject identifier types.

3.1

    If this identifier type is going to be restricted to user accounts (by RFC7565), then I think it should be called the "User Account Subject Identifier Type" with a "subject_type" value of "user-account". Devices can also have accounts.

7.1.1
    Should the controller be updated to "OpenID Foundation Shared Signals and Events Working Group" to reflect the new name of the group?

7.1.2.1
    See feedback for 3.1

Tim

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 13 Jul 2020 19:42:24 +0000

Thanks for the review, Tim! Replies are [richanna] inline [/richanna].

–
Annabelle Backman (she/her)
AWS Identity
https://aws.amazon.com/identity/

From: Id-event <[email-masked]> on behalf of Tim Cappalli <Tim.Cappalli=[email-masked]>
Date: Monday, July 13, 2020 at 11:11 AM
To: "[email-masked]" <[email-masked]>
Subject: [EXTERNAL] [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli)

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Here’s my feedback:

3.

                [richanna]
Agreed. This has been brought up a few times now, so there’s pretty clearly a need for it. We can allow for unregistered names similar to how JWT allows for unregistered claims.
[/richanna]

3.1

                [richanna]
                I don’t see a reason why this needs to be restricted to user accounts. We should just strike “user” from the first sentence.
[/richanna]

7.1.1

                [richanna]
                This never got edited when we moved this work from OIDF to here. Should be updated to IETF.
[/richanna]

7.1.2.1
    See feedback for 3.1

Tim

---

From: Tim Cappalli <[email-masked]>
Date: Tue, 14 Jul 2020 15:55:01 +0000

Just removing “User” and making it “Account Subject Identifier” makes sense to me!

tim

From: Richard Backman, Annabelle <richanna=[email-masked]>
Date: Monday, July 13, 2020 at 15:43
To: Tim Cappalli <[email-masked]>, [email-masked] <[email-masked]>
Subject: Re: [Id-event] Feedback: draft-ietf-secevent-subject-identifiers-05 (Tim Cappalli)
Thanks for the review, Tim! Replies are [richanna] inline [/richanna].

–
Annabelle Backman (she/her)
AWS Identity
https://aws.amazon.com/identity/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Faws.amazon.com%2Fidentity%2F&data=02%7C01%7CTim.Cappalli%40microsoft.com%7Ceb85afdfa1cc438e480208d82764f4ea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637302662146929830&sdata=qTdkVOfuUVhtBL6fJJzzmKmqulwlGZAk8HwK2MeFowA%3D&reserved=0>

Here’s my feedback:

3.

                [richanna]

3.1

                [richanna]

7.1.1

                [richanna]

7.1.2.1
    See feedback for 3.1

Tim