Subject: Re: [Txauth] [UNVERIFIED SENDER] Questions on the TxAuth charter

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 5 Feb 2020 10:32:05 +0100

Hi Annabelle, 

> On 29. Jan 2020, at 21:15, Richard Backman, Annabelle <richanna=[email-masked]> wrote:
> 
> I am well aware of the fact that OIDC Core predates ODC4IDA, and that the claims I am referring to are defined in the former, as noted in my previous message. Telling me to use verified_claims is not helpful when I’ve already stated that I have looked at that spec and it does not appear to address my use case. I’d appreciate less condescension and more attention to message content, thanks.

sorry, I did not intend to sound condescending. I always appreciate your contributions and did not change my mind. I tried to enter into a conversation how OIDC4IDA could address your use case and I believe I have read all of your messages.

Let me recapitulate:

You stated that 

> 	• The ..._verified claims don’t define how or when verification occurred.
 
I replied by stating that OIDC4IDA indeed supports the “how" and the “when" by means of the “method" and “time" elements in the “verification” sub-element. 

You replied 

> I was referring to the email_verified and phone_number_verified claims defined in OIDC Core. The mechanisms defined in IA don’t appear to apply to those claims. Am I missing something?

Which kind of puzzled me since your previous statement was related to OIDC4IDA and not the OIDC claims. 

That’s why I replied by pointing out the obvious (perhaps I should have stated clearer) that email_verified and phone_number_verified was invented before OIDC4IDA and so does not use its concepts/constructs. I also tried to explained how you (potentially) could use OIDC4IDA for your purposes.

> It requires a trust framework id determining the trust framework governing the verification along with identifiers for verification methods etc.

This is how it could look like

{ 
   "verified_claims":{ 
      "verification":{ 
         "trust_framework":"email_trust_framework",
         "time":"2018-05-21T18:25:43.511+01",
         "evidence":[ 
            { 
               "method":"code_in_email"
            }
         ]
      },
      "claims":{ 
         "email":"[email-masked]"
      }
   }
}

It’s just a guess. OIDC4IDA was developed with assurance of natural person claims in mind. But I would like to find out with your help whether it also fits a broader scope.

best regards,
Torsten. 

>  
> – 
> Annabelle Richard Backman
> AWS Identity
>  
>  
> From: Torsten Lodderstedt <torsten=[email-masked]>
> Date: Wednesday, January 29, 2020 at 11:45 AM
> To: "Richard Backman, Annabelle" <[email-masked]>
> Cc: Kim <[email-masked]>, "[email-masked]" <[email-masked]>, Justin Richer <[email-masked]>, Dick Hardt <[email-masked]>
> Subject: [UNVERIFIED SENDER] Re: [Txauth] Questions on the TxAuth charter
>  
>  
> 
> 
>> Am 29.01.2020 um 19:49 schrieb Richard Backman, Annabelle <richanna=[email-masked]>:
>> 
>> 
>> I was referring to the email_verified and phone_number_verified claims defined in OIDC Core. The mechanisms defined in IA don’t appear to apply to those claims. Am I missing something?
>  
> Those claims pre-date OIDC4IDA. If they do not suite your needs, you may use verified_claims to represent the verification status. It requires a trust framework id determining the trust framework governing the verification along with identifiers for verification methods etc.
> 
> 
>>  
>> (I do have some feedback regarding claims in IA…getting on the IA working group list and providing it is on my far-too-long todo list…)
>  
> look forward to getting your feedback.
> 
> 
>> – 
>> Annabelle Richard Backman
>> AWS Identity
>>  
>>  
>> From: Txauth <[email-masked]> on behalf of Torsten Lodderstedt <torsten=[email-masked]>
>> Date: Tuesday, January 28, 2020 at 9:13 PM
>> To: "Richard Backman, Annabelle" <richanna=[email-masked]>
>> Cc: Kim <[email-masked]>, "[email-masked]" <[email-masked]>, Justin Richer <[email-masked]>, Dick Hardt <[email-masked]>
>> Subject: Re: [Txauth] Questions on the TxAuth charter
>>  
>>  
>> 
>> 
>> 
>>> Am 28.01.2020 um 18:00 schrieb Richard Backman, Annabelle <richanna=[email-masked]>:
>>> 
>>> The ..._verified claims don’t define how or when verification occurred.
>>  
>> Sure, they do. Look at the time and method fields. 
>>  
>> Since OpenId Connect for Identity Assurance (aka verified_claims) is ongoing work feel free to contribute.
>>  
>> https://openid.net/wg/ekyc-ida/

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Wed, 5 Feb 2020 17:45:39 +0000

> On Feb 5, 2020, at 1:34 AM, Torsten Lodderstedt <torsten=[email-masked]> wrote:
> 

I am really not sure where you are getting this idea from. I was pointing out issues/limitations with OIDC claims, and referenced claims defined in Core. I did not bring up OIDC4IDA at all until you did.

Regardless, while both use the word “verified” I’m not sure that the use cases for these claims in Core actually match up that well with those of OIDC4IDA. But that’s a topic for a different mailing list.