Subject: [OAUTH-WG] define a client_id JWT claim (in Token Exchange)?

From: Brian Campbell <[email-masked]>
Date: Mon, 20 Jun 2016 15:21:30 -0600

There is a somewhat poorly worded open issue in Token Exchange about being
able to represent the client in the token.

There is currently no standard claim for the client in JWT while Token
Introspection defines a "client_id" parameter. It's maybe not the ideal
place for it but Token Exchange could define such a claim for JWT.

I'm looking for some feedback from the WG on if/how to proceed with this in
Token Exchange. As I see it, there are basically 3 options:

1) Define and register a "client_id" JWT claim (consistent with the name in
Token Introspection) to carry the client id of the OAuth 2.0 client that
requested the token.

2) Define and register a "cid" JWT claim (consistent with the shorter names
typical for JWT) to carry the client id of the OAuth 2.0 client that
requested the token.

3) Do not define/register any new JWT claim for the client identifier (in
the Token Exchange draft anyway).

Feedback/preferences would be appreciated from the WG so as to make some
progress on the draft.

If pressed, I guess I'd lean towards option #1 myself.

---

From: Justin Richer <[email-masked]>
Date: Mon, 20 Jun 2016 18:22:13 -0400

+1 for “cid”, consistent with other JWT claims.

 — Justin

> On Jun 20, 2016, at 5:21 PM, Brian Campbell <[email-masked]> wrote:
> 
> There is a somewhat poorly worded open issue in Token Exchange about being able to represent the client in the token. 
> 
> There is currently no standard claim for the client in JWT while Token Introspection defines a "client_id" parameter. It's maybe not the ideal place for it but Token Exchange could define such a claim for JWT.
> 
> I'm looking for some feedback from the WG on if/how to proceed with this in Token Exchange. As I see it, there are basically 3 options:
> 
> 1) Define and register a "client_id" JWT claim (consistent with the name in Token Introspection) to carry the client id of the OAuth 2.0 client that requested the token.
> 
> 2) Define and register a "cid" JWT claim (consistent with the shorter names typical for JWT) to carry the client id of the OAuth 2.0 client that requested the token.
> 
> 3) Do not define/register any new JWT claim for the client identifier (in the Token Exchange draft anyway). 
> 
> Feedback/preferences would be appreciated from the WG so as to make some progress on the draft. 
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Tue, 21 Jun 2016 10:34:54 -0400

I prefer “cid” as the claim name rather than trying to match the parameter name.

John B.
> On Jun 20, 2016, at 6:22 PM, Justin Richer <[email-masked]> wrote:
>

---

From: Chuck Mortimore <[email-masked]>
Date: Tue, 21 Jun 2016 08:35:02 -0700

+1 for cid

> On Jun 21, 2016, at 7:35 AM, John Bradley <[email-masked]> wrote:
>

---

From: Brian Campbell <[email-masked]>
Date: Tue, 21 Jun 2016 15:49:18 -0600

Seems like there's roughly rough condenses for "cid". Thanks.

On Tue, Jun 21, 2016 at 9:35 AM, Chuck Mortimore <[email-masked]>
wrote:

> >>> There is a somewhat poorly worded open issue in Token Exchange about
> being able to represent the client in the token.
> >>>
> >>> I'm looking for some feedback from the WG on if/how to proceed with
> this in Token Exchange. As I see it, there are basically 3 options:
> >>>
> >>> 1) Define and register a "client_id" JWT claim (consistent with the
> name in Token Introspection) to carry the client id of the OAuth 2.0 client
> that requested the token.
> >>>
> >>> 2) Define and register a "cid" JWT claim (consistent with the shorter
> names typical for JWT) to carry the client id of the OAuth 2.0 client that
> requested the token.
> >>>

---

From: Brian Campbell <[email-masked]>
Date: Wed, 22 Jun 2016 09:34:00 -0600

er... s:/condenses/consensus/
Seems like there's roughly rough condenses for "cid". Thanks.