Subject: [OAUTH-WG] Comments on draft-ietf-oauth-json-web-token-05

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 24 Nov 2012 19:47:06 +0100

Hi,

I've got a few comments on your draft.

I’m wondering why neither acr nor auth_time (which are used in OIDC) 
made their way into this spec?

What is the difference between prn and the user_id claim OIDC uses?

regards,
Torsten.

---

From: John Bradley <[email-masked]>
Date: Mon, 26 Nov 2012 11:26:39 -0300

JWT is more generic than OIDC.

prn and user_id as used by OIDC are similar.   user_id is already in wide use with Facebook's signed request.  
We were hoping that Facebook would be more likely to migrate from signed request to JWT if the parameter names stayed the same for developers.

In the generic case of a JWT the prn may not be a user.   

The other discussion that I recall around prn was a notion that they are fully qualified and globally unique.

We wanted to be clear with user_id that it is scoped to the iss and not globally unique.

So a prn was seen as a User Principal name and the user_id was seen as a persistent non reassignable identifier for the user in the context of the iss.

John B.

On 2012-11-24, at 3:47 PM, Torsten Lodderstedt <[email-masked]> wrote:

> I’m wondering why neither acr nor auth_time (which are used in OIDC) made their way into this spec?
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 26 Nov 2012 19:46:51 +0100

Hi John

thanks for the explanatian. Just to make sure I got you right. A prn can be a user_id. A prn is bound to the scope of an iss.

Regards,
Torsten.

John Bradley <[email-masked]> schrieb:

>We were hoping that Facebook would be more likely to migrate from
>signed request to JWT if the parameter names stayed the same for
>developers.
>
>So a prn was seen as a User Principal name and the user_id was seen as
>a persistent non reassignable identifier for the user in the context of
>the iss.
>
>John B.
>
>

---

From: John Bradley <[email-masked]>
Date: Mon, 26 Nov 2012 15:51:05 -0300

A user_id is scoped to a iss.

There is some notion that a prn is globally unique, though the JWT spec is not clear on that.   I think people are thinking of it like a UPN in LDAP/AD.

John B.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 26 Nov 2012 19:56:15 +0100

Hi John,

does it make sense to change the spec as follows:

- specify the prn claim as being globally unqiue
- add user_id as scoped by iss claim

What do you think?

regards,
Torsten.

Am 26.11.2012 19:51, schrieb John Bradley:
> There is some notion that a prn is globally unique, though the JWT 
> spec is not clear on that.   I think people are thinking of it like a 
> UPN in LDAP/AD.
>
> John B.
> On 2012-11-26, at 3:46 PM, Torsten Lodderstedt 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>> Hi John
>>
>> thanks for the explanatian. Just to make sure I got you right. A prn 
>> can be a user_id. A prn is bound to the scope of an iss.
>>
>> Regards,
>> Torsten.
>>
>>
>>
>> John Bradley <[email-masked] <mailto:[email-masked]>> schrieb:
>>
>>     On 2012-11-24, at 3:47 PM, Torsten Lodderstedt <[email-masked]  <mailto:[email-masked]>> wrote:
>>
>>         Hi, I've got a few comments on your draft. I’m wondering why
>>         neither acr nor auth_time (which are used in OIDC) made their
>>         way into this spec? What is the difference between prn and
>>         the user_id claim OIDC uses? regards, Torsten.
>>
>>
>>
>

---

From: John Bradley <[email-masked]>
Date: Mon, 26 Nov 2012 16:04:10 -0300

I don't know that we need user_id in the JWT spec it may be enough to have it as a OIDC extension if it is not globally useful.

I agree that the definition of prn should be more specific.

---

From: Mike Jones <[email-masked]>
Date: Wed, 28 Nov 2012 05:50:06 +0000

I'll add it to my to-do list to define "prn" as being globally unique.

                                                            -- Mike

From: John Bradley [mailto:[email-masked]]
Sent: Monday, November 26, 2012 11:04 AM
To: Torsten Lodderstedt
Cc: OAuth WG; Mike Jones; Nat Sakimura
Subject: Re: Comments on draft-ietf-oauth-json-web-token-05

I agree that the definition of prn should be more specific.
On 2012-11-26, at 3:56 PM, Torsten Lodderstedt <[email-masked]<mailto:[email-masked]>> wrote:

Hi John,

What do you think?

regards,
Torsten.

John B.
On 2012-11-26, at 3:46 PM, Torsten Lodderstedt <[email-masked]<mailto:[email-masked]>> wrote:

Hi John

Regards,
Torsten.

John Bradley <[email-masked]<mailto:[email-masked]>> schrieb:

John B.

On 2012-11-24, at 3:47 PM, Torsten Lodderstedt <[email-masked]<mailto:[email-masked]>> wrote:

Hi,

I'm wondering why neither acr nor auth_time (which are used in OIDC) made their way into this spec?

regards,

Torsten.