Subject: [Id-event] Common claims in subject identifiers

From: Atul Tulshibagwale <[email-masked]>
Date: Mon, 13 Jul 2020 09:14:36 -0700

Hi all,
The proposed subject identifiers specification today requires that each
claim within a subject identifier be specified by the individual subject
identifier type. However, there may be some common claims that could be
defined across all subject identifier types. These are captured within the
"common claims" section of my proposal. All such common claims may be
optional unless a specific subject identifier type requires any of them
(there is no example of that today). These claims include:

   - *SPAG Identifier*: Identifies the "Subject Principal Administrative
   Grouping" or SPAG that the subject identifier belongs to
   - *Subject Category*: identifies the category that the subject
   identifier refers to (whether user, device or session)

To avoid having to define these claims within each subject identifier type,
I have extracted them into a separate section called "common claims" in my
proposal <https://github.com/richanna/secevent/pull/1>.

Thanks,
Atul

---

From: Dick Hardt <[email-masked]>
Date: Mon, 13 Jul 2020 11:21:48 -0700

Atul: would you provide a couple use cases and examples to explain your
proposal?
ᐧ

On Mon, Jul 13, 2020 at 9:15 AM Atul Tulshibagwale <atultulshi=
[email-masked]> wrote:

> To avoid having to define these claims within each subject identifier
> type, I have extracted them into a separate section called "common claims"
> in my proposal <https://github.com/richanna/secevent/pull/1>.
>
> Thanks,
> Atul
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event
>

---

From: Atul Tulshibagwale <[email-masked]>
Date: Mon, 13 Jul 2020 13:36:55 -0700

Hi Dick,
Here's an example of a subject identifier with common claims:

{
  "subject_type": "phone-number",
  "cateogry": "device",
  "spag_id" : "
https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
  "phone_number": "+1 (408) 555-1212",
}

In the above example, the "category" claim and the "spag_id" claim are not
defined in the phone_number subject identifier type, but they are defined
as common claims that may appear in subject identifiers of any type. To
disambiguate whether the subject refers to the user that is identified by
the phone number or the device that has that phone number, the category
claim is important. To disambiguate which management unit the user is being
referred to, the spag_id is important.

The above example is in the PR. Another example (not in the PR) is:

{
  "subject_type": "email",
  "spag_id" : "
https://example.com/v2/Groups/e9e30dba-f08f-4109-8486-d5c6a331660a",
  "email": "[email-masked]",
}

In the above example, it might be important for the "spag_id" to be
specified if the same user exists in multiple SPAGs in the receiver of the
event. For example, the same user may belong to multiple groups and an
event like, say, "access rights SoD conflict" may relate to their presence
in one group and not another.

Thanks,
Atul

---

From: Dick Hardt <[email-masked]>
Date: Mon, 13 Jul 2020 14:00:28 -0700

Got it, thanks!
ᐧ

On Mon, Jul 13, 2020 at 1:37 PM Atul Tulshibagwale <[email-masked]>
wrote:

>>>    - *SPAG Identifier*: Identifies the "Subject Principal
>>>    Administrative Grouping" or SPAG that the subject identifier belongs to