OpenID Connect standard claims registration for CBOR Web Tokens
Internet-Draft draft-maldant-spice-oidc-cwt-00
Beltram Maldant
SimpleLogin
beltram.ietf@pm.me
12 July 2024
Security
Secure Patterns for Internet CrEdentials
openid connect
oidc
standard claims
This document registers OpenId Connect standards claims already used in JSON Web Tokens for CBOR Web Tokens.
About This Document
The latest revision of this draft can be found at https://beltram.github.io/rfc-spice-oidc-cwt/draft-maldant-spice-oidc-cwt.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-maldant-spice-oidc-cwt/.
Discussion of this document takes place on the Secure Patterns for Internet CrEdentials Working Group mailing list (mailto:spice@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/spice/. Subscribe at https://www.ietf.org/mailman/listinfo/spice/.
Source for this draft and an issue tracker can be found at https://github.com/beltram/rfc-spice-oidc-cwt.
Introduction
OpenId Connect [OIDCCore] is an authentication standard including standard claims already in use for JSON Web Tokens (JWT) [RFC7519]. CBOR Web Tokens (CWT) [RFC8392] have a claims registry, but do not include most of these claims. This draft aims at unifying use of OIDC claims in JWTs and CWTs.
Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
Security Considerations
This document registers existing OpenID Connect standard claims already used in JSON Web Tokens [RFC7519] for use in CBOR Web Tokens [RFC8392] without changing their semantics. The Security and Privacy Considerations respectively of Sections 16 and 17 of [OIDCCore] also apply.
IANA Considerations
name
- Claim Name: name
- Claim Description: End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences.
- JWT Claim Name: name
- Claim Key: 170
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
given_name
- Claim Name: given_name
- Claim Description: Given name(s) or first name(s) of the End-User.
- JWT Claim Name: given_name
- Claim Key: 171
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
family_name
- Claim Name: family_name
- Claim Description: Surname(s) or last name(s) of the End-User.
- JWT Claim Name: family_name
- Claim Key: 172
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
middle_name
- Claim Name: middle_name
- Claim Description: Middle name(s) of the End-User.
- JWT Claim Name: middle_name
- Claim Key: 173
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
nickname
- Claim Name: nickname
- Claim Description: Casual name of the End-User that may or may not be the same as the given_name.
- JWT Claim Name: nickname
- Claim Key: 174
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
preferred_username
- Claim Name: preferred_username
- Claim Description: Shorthand name by which the End-User wishes to be referred to at the Resource Server.
- JWT Claim Name: preferred_username
- Claim Key: 175
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
profile
- Claim Name: profile
- Claim Description: URL of the End-User's profile page.
- JWT Claim Name: profile
- Claim Key: 176
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
picture
- Claim Name: picture
- Claim Description: URL of the End-User's profile picture. This URL MUST refer to an image file, rather than to a Web page containing an image.
- JWT Claim Name: picture
- Claim Key: 177
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
website
- Claim Name: website
- Claim Description: URL of the End-User's Web page or blog.
- JWT Claim Name: website
- Claim Key: 178
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
email
- Claim Name: email
- Claim Description: End-User's preferred e-mail address.
- JWT Claim Name: email
- Claim Key: 179
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
email_verified
- Claim Name: email_verified
- Claim Description: True if the End-User's e-mail address has been verified; otherwise false.
- JWT Claim Name: email_verified
- Claim Key: 180
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
gender
- Claim Name: gender
- Claim Description: End-User's defined gender.
- JWT Claim Name: gender
- Claim Key: 181
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
birthdate
- Claim Name: birthdate
- Claim Description: End-User's birthday, represented as an [ISO8601_1] YYYY-MM-DD format.
- JWT Claim Name: birthdate
- Claim Key: 182
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
zoneinfo
- Claim Name: zoneinfo
- Claim Description: String from IANA Time Zone Database [IANAtimezones] representing the End-User's time zone.
- JWT Claim Name: zoneinfo
- Claim Key: 183
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
locale
- Claim Name: locale
- Claim Description: End-User's locale, represented as a BCP47 [RFC5646] language tag.
- JWT Claim Name: locale
- Claim Key: 184
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
phone_number
- Claim Name: phone_number
- Claim Description: End-User's preferred telephone number.
- JWT Claim Name: phone_number
- Claim Key: 185
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
phone_number_verified
- Claim Name: phone_number_verified
- Claim Description: True if the End-User's phone number has been verified; otherwise false.
- JWT Claim Name: phone_number_verified
- Claim Key: 186
- Claim Value Type(s): text string
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
address
- Claim Name: address
- Claim Description: End-User's preferred postal address.
- JWT Claim Name: address
- Claim Key: 187
- Claim Value Type(s): text string (the content is a JSON array)
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
updated_at
- Claim Name: updated_at
- Claim Description: Time the End-User's information was last updated. Its value is a number representing the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time.
- JWT Claim Name: updated_at
- Claim Key: 188
- Claim Value Type(s): uint
- Change Controller: IESG
- Specification Document(s): Section 5.1 of [OIDCCore]
References
Normative References
[OIDCCore]

OpenID Connect Core 1.0 incorporating errata set 2
Nat Sakimura
John Bradley
Michael B. Jones
Breno de Medeiros
Chuck Mortimore
15 December 2023
[IANAtimezones]

IANA time zones
n.d.
[ISO8601_1]

ISO8601‑1
n.d.
[RFC8392]

CBOR Web Token (CWT)
M. Jones
E. Wahlstroem
S. Erdtman
H. Tschofenig
May 2018
RFC 8392
DOI 10.17487/RFC8392
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
[RFC5646]

Tags for Identifying Languages
A. Phillips, Ed.
M. Davis, Ed.
September 2009
BCP 47
RFC 5646
DOI 10.17487/RFC5646
Informative References
[RFC7519]

JSON Web Token (JWT)
M. Jones
J. Bradley
N. Sakimura
May 2015
RFC 7519
DOI 10.17487/RFC7519