Subject: [Id-event] URN name space for secevent profiles

From: Marius Scurtescu <[email-masked]>
Date: Tue, 11 Apr 2017 15:42:38 -0700

Different secevent profiles will have to define URIs for event types and
most likely if standardized most of these URIs will be defined as URNs.

secevent could define the URN name space under which profiles can define
their own URNs.

The proposal is to use URN sub-delegation for "ietf" namespace (RFC 3553),
something like:
urn:ietf:params:secevent:event-type:<profile-id>:<event-id>

As an example, RISC could define the following event types:
urn:ietf:params:secevent:event-type:risc:sessions-revoked
urn:ietf:params:secevent:event-type:risc:tokens-revoked
urn:ietf:params:secevent:event-type:risc:account-deleted
urn:ietf:params:secevent:event-type:risc:all

Similarly, secevent could define a URN prefix for the aud claim (to avoid
access token and id token collisions):
urn:ietf:params:secevent:aud-client-id:<client-id>

Thoughts?

Marius

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Tue, 11 Apr 2017 16:44:28 -0700

I think there is a community that wants uris for more informal events to be used. I can see a need for localized signalling extensions. 

I had originally proposed a urn namespace (back then idevents). 

As editor, I am not sure if typical IETF practices would allow for a urn registry defined against an informal uri value. Can we have it both ways? 

As an individual, I do see a lot of potential mis-use and overlap for profiling specs.  I see value in a centralized review process-especially from a privacy perspective. 

Phil

> On Apr 11, 2017, at 3:42 PM, Marius Scurtescu <[email-masked]> wrote:
> 
> Different secevent profiles will have to define URIs for event types and most likely if standardized most of these URIs will be defined as URNs.
> 
> secevent could define the URN name space under which profiles can define their own URNs.
> 
> The proposal is to use URN sub-delegation for "ietf" namespace (RFC 3553), something like:
> Similarly, secevent could define a URN prefix for the aud claim (to avoid access token and id token collisions):
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oZ0Tb89dCBSBgwLLRDIDLczGm87hfRchTotcA3SYgQ0&s=EssAI-pib4nIOLNIKyzJc8bXB8dFHrDnUv8G6P3PORc&e=

---

From: Justin Richer <[email-masked]>
Date: Wed, 12 Apr 2017 15:41:19 -0400

We can absolutely do both URN and generic URI, since the former is a subset of the latter. We’ve got the same construct with OAuth grant types.

 — Justin

> On Apr 11, 2017, at 7:44 PM, Phil Hunt (IDM) <[email-masked]> wrote:
> 
>> On Apr 11, 2017, at 3:42 PM, Marius Scurtescu <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oZ0Tb89dCBSBgwLLRDIDLczGm87hfRchTotcA3SYgQ0&s=EssAI-pib4nIOLNIKyzJc8bXB8dFHrDnUv8G6P3PORc&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oZ0Tb89dCBSBgwLLRDIDLczGm87hfRchTotcA3SYgQ0&s=EssAI-pib4nIOLNIKyzJc8bXB8dFHrDnUv8G6P3PORc&e=> 
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/id-event <https://www.ietf.org/mailman/listinfo/id-event>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Wed, 12 Apr 2017 12:58:58 -0700

Technically yes. 

The problem I foresee is justifying the iana registry and the process for approval. Why do we need it if we aren't requiring use?

For me it was never an enforcement issue it was always a centralized registry to promote re-use and document authoritative definitions. 

Phil

> On Apr 12, 2017, at 12:41 PM, Justin Richer <[email-masked]> wrote:
> 
>> https://www.ietf.org/mailman/listinfo/id-event
> 
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=uKnsFOlCUvRP6YASCrwoT8fvVXzXcTebq3BBj6SWMLQ&s=lPnH_DCHKRiBW7VVLByeFGKlrKQK6AGEwbVcG9n8bZE&e=

---

From: Mike Jones <[email-masked]>
Date: Wed, 12 Apr 2017 20:21:58 +0000

URIs (which can be URNs or URLs) work well, since people can use namespaces they are authoritative for when defining events.

                                                                -- Mike

From: Id-event [mailto:[email-masked]] On Behalf Of Phil Hunt (IDM)
Sent: Wednesday, April 12, 2017 12:59 PM
To: Justin Richer <[email-masked]>
Cc: ID Events Mailing List <[email-masked]>; Marius Scurtescu <[email-masked]>
Subject: Re: [Id-event] URN name space for secevent profiles

Technically yes.

Phil

On Apr 12, 2017, at 12:41 PM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
We can absolutely do both URN and generic URI, since the former is a subset of the latter. We’ve got the same construct with OAuth grant types.

 — Justin

On Apr 11, 2017, at 7:44 PM, Phil Hunt (IDM) <[email-masked]<mailto:[email-masked]>> wrote:

Phil

On Apr 11, 2017, at 3:42 PM, Marius Scurtescu <[email-masked]<mailto:[email-masked]>> wrote:

Thoughts?

Marius
_______________________________________________
Id-event mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=oZ0Tb89dCBSBgwLLRDIDLczGm87hfRchTotcA3SYgQ0&s=EssAI-pib4nIOLNIKyzJc8bXB8dFHrDnUv8G6P3PORc&e=

_______________________________________________
Id-event mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/id-event<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=uKnsFOlCUvRP6YASCrwoT8fvVXzXcTebq3BBj6SWMLQ&s=lPnH_DCHKRiBW7VVLByeFGKlrKQK6AGEwbVcG9n8bZE&e=>

_______________________________________________
Id-event mailing list
[email-masked]<mailto:[email-masked]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=uKnsFOlCUvRP6YASCrwoT8fvVXzXcTebq3BBj6SWMLQ&s=lPnH_DCHKRiBW7VVLByeFGKlrKQK6AGEwbVcG9n8bZE&e=

---

From: William Denniss <[email-masked]>
Date: Thu, 13 Apr 2017 14:48:25 -0700

So from a technical spec point of view, documenting it as URI to allow both
URN and URI makes sense.

Then it's a question of: is anyone clamoring for URN registry currently?
If they are, create the registry, seeded with those values. Otherwise leave
that part for now.  E.g. does back channel logout or RISC desire a URN?

On Wed, Apr 12, 2017 at 12:58 PM, Phil Hunt (IDM) <[email-masked]>
wrote:

> Technically yes.
>
> The problem I foresee is justifying the iana registry and the process for
> approval. Why do we need it if we aren't requiring use?
>
> For me it was never an enforcement issue it was always a centralized
> registry to promote re-use and document authoritative definitions.
>
> Phil
>
> We can absolutely do both URN and generic URI, since the former is a
> subset of the latter. We’ve got the same construct with OAuth grant types.
>
>  — Justin
>
>
> I think there is a community that wants uris for more informal events to
> be used. I can see a need for localized signalling extensions.
>
> As editor, I am not sure if typical IETF practices would allow for a urn
> registry defined against an informal uri value. Can we have it both ways?
>
> As an individual, I do see a lot of potential mis-use and overlap for
> profiling specs.  I see value in a centralized review process-especially
> from a privacy perspective.
>
> Phil
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.
> ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=
> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=
> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=
> oZ0Tb89dCBSBgwLLRDIDLczGm87hfRchTotcA3SYgQ0&s=EssAI-
> pib4nIOLNIKyzJc8bXB8dFHrDnUv8G6P3PORc&e=
>
>
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=uKnsFOlCUvRP6YASCrwoT8fvVXzXcTebq3BBj6SWMLQ&s=lPnH_DCHKRiBW7VVLByeFGKlrKQK6AGEwbVcG9n8bZE&e=>
>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.
> ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=
> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=
> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=
> uKnsFOlCUvRP6YASCrwoT8fvVXzXcTebq3BBj6SWMLQ&s=lPnH_
> DCHKRiBW7VVLByeFGKlrKQK6AGEwbVcG9n8bZE&e=
>
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 13 Apr 2017 21:50:41 +0000

I think the OpenID specifications using events do not need a registry, and are better served by using URIs rooted at openid.net.

From: Id-event [mailto:[email-masked]] On Behalf Of William Denniss
Sent: Thursday, April 13, 2017 2:48 PM
To: Phil Hunt (IDM) <[email-masked]>
Cc: ID Events Mailing List <[email-masked]>; Justin Richer <[email-masked]>; Marius Scurtescu <[email-masked]>
Subject: Re: [Id-event] URN name space for secevent profiles

So from a technical spec point of view, documenting it as URI to allow both URN and URI makes sense.

Then it's a question of: is anyone clamoring for URN registry currently?  If they are, create the registry, seeded with those values. Otherwise leave that part for now.  E.g. does back channel logout or RISC desire a URN?

On Wed, Apr 12, 2017 at 12:58 PM, Phil Hunt (IDM) <[email-masked]<mailto:[email-masked]>> wrote:
Technically yes.

Phil

 — Justin

Phil

Thoughts?

Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 18 Apr 2017 15:20:34 -0700

I think the conclusion is to use URIs in the specs and leave it to each
profile to decide on URN vs URL. The RISC profile showed strong preference
for URL based URIs, like:
http://schemas.openid.net/risc/event/account-deleted

Marius

On Thu, Apr 13, 2017 at 2:50 PM, Mike Jones <[email-masked]>
wrote:

> I think the OpenID specifications using events do not need a registry, and
> are better served by using URIs rooted at openid.net.
>
>
>
> *From:* Id-event [mailto:[email-masked]] *On Behalf Of *William
> Denniss
> *Sent:* Thursday, April 13, 2017 2:48 PM
> *To:* Phil Hunt (IDM) <[email-masked]>
> *Cc:* ID Events Mailing List <[email-masked]>; Justin Richer <
> [email-masked]>; Marius Scurtescu <[email-masked]>
> *Subject:* Re: [Id-event] URN name space for secevent profiles
>
>
>

---

From: Mike Jones <[email-masked]>
Date: Tue, 18 Apr 2017 22:23:20 +0000

I’d actually do it in the other order.  I think that all OpenID-defined events from all working groups should start with http://schemas.openid.net/event/.  The event name should follow that, which may optionally include a working group name as part of the event name.  So the right name for account-deleted, if “risc” is to be included, is http://schemas.openid.net/event/risc/account-deleted.

                                                                -- Mike

P.S.  Yes, these OpenID-defined names are up to the relevant OpenID working groups, but given that the example was sent to this list, I thought I’d also reply here, since I think the name components should come in in logical order described above.

From: Marius Scurtescu [mailto:[email-masked]]
Sent: Tuesday, April 18, 2017 3:21 PM
To: Mike Jones <[email-masked]>
Cc: William Denniss <[email-masked]>; Phil Hunt (IDM) <[email-masked]>; ID Events Mailing List <[email-masked]>; Justin Richer <[email-masked]>
Subject: Re: [Id-event] URN name space for secevent profiles

I think the conclusion is to use URIs in the specs and leave it to each profile to decide on URN vs URL. The RISC profile showed strong preference for URL based URIs, like:
http://schemas.openid.net/risc/event/account-deleted

Marius

On Thu, Apr 13, 2017 at 2:50 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
I think the OpenID specifications using events do not need a registry, and are better served by using URIs rooted at openid.net<http://openid.net>.

From: Id-event [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of William Denniss
Sent: Thursday, April 13, 2017 2:48 PM
To: Phil Hunt (IDM) <[email-masked]<mailto:[email-masked]>>
Cc: ID Events Mailing List <[email-masked]<mailto:[email-masked]>>; Justin Richer <[email-masked]<mailto:[email-masked]>>; Marius Scurtescu <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Id-event] URN name space for secevent profiles

Phil

 — Justin

Phil

Thoughts?

Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 18 Apr 2017 15:26:57 -0700

Why scatter each profile across multiple root paths?

Most likely there will be other URIs than event type.

Marius

On Tue, Apr 18, 2017 at 3:23 PM, Mike Jones <[email-masked]>
wrote:

> I’d actually do it in the other order.  I think that all OpenID-defined
> events from all working groups should start with
> http://schemas.openid.net/event/.  The event name should follow that,
> which may optionally include a working group name as part of the event
> name.  So the right name for account-deleted, if “risc” is to be included,
> is http://schemas.openid.net/event/risc/account-deleted.
>
>
>
>                                                                 -- Mike
>
>
>
> P.S.  Yes, these OpenID-defined names are up to the relevant OpenID
> working groups, but given that the example was sent to this list, I thought
> I’d also reply here, since I think the name components should come in in
> logical order described above.
>
>
>
> *From:* Marius Scurtescu [mailto:[email-masked]]
> *Sent:* Tuesday, April 18, 2017 3:21 PM
> *To:* Mike Jones <[email-masked]>
> *Cc:* William Denniss <[email-masked]>; Phil Hunt (IDM) <
> [email-masked]>; ID Events Mailing List <[email-masked]>; Justin
> Richer <[email-masked]>
>

---

From: Mike Jones <[email-masked]>
Date: Tue, 18 Apr 2017 22:29:49 +0000

Why scatter events across multiple root paths?

Sent: Tuesday, April 18, 2017 3:27 PM

Marius

On Tue, Apr 18, 2017 at 3:23 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
I’d actually do it in the other order.  I think that all OpenID-defined events from all working groups should start with http://schemas.openid.net/event/.  The event name should follow that, which may optionally include a working group name as part of the event name.  So the right name for account-deleted, if “risc” is to be included, is http://schemas.openid.net/event/risc/account-deleted.

                                                                -- Mike

From: Marius Scurtescu [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, April 18, 2017 3:21 PM
To: Mike Jones <[email-masked]<mailto:[email-masked]>>
Cc: William Denniss <[email-masked]<mailto:[email-masked]>>; Phil Hunt (IDM) <[email-masked]<mailto:[email-masked]>>; ID Events Mailing List <[email-masked]<mailto:[email-masked]>>; Justin Richer <[email-masked]<mailto:[email-masked]>>

Marius

Phil

 — Justin

Phil

Thoughts?

Marius

---

From: Marius Scurtescu <[email-masked]>
Date: Tue, 18 Apr 2017 15:32:37 -0700

> Why scatter events across multiple root paths?

I just replied on the other thread. I think we interpreted "event"
differently.

If we want to capture the working group name then we should use the full
name, like:
http://schemas.openid.net/secevent/risc/event/account-deleted

maybe:
http://schemas.openid.net/secevent/risc/event-type/account-deleted

> *Sent:* Tuesday, April 18, 2017 3:27 PM
>

---

From: Mike Jones <[email-masked]>
Date: Tue, 18 Apr 2017 22:36:00 +0000

I meant “event” to designate a SET definition, “risc” to designate the (optional) working group name, “http://schemas.openid.net” root the name in an OpenID namespace, and “account-deleted” to be the WG-specific event name.

Having both “secevent” and “event” is redundant.

                                                                -- Mike

P.S.  Given that this is actually an OpenID foundation naming discussion, we should probably either be having it on [email-masked]<mailto:[email-masked]> or [email-masked]<mailto:[email-masked]> but not here.  It’s fine to announce the result here after the working group reaches consensus.

Sent: Tuesday, April 18, 2017 3:33 PM

On Tue, Apr 18, 2017 at 3:29 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:
Why scatter events across multiple root paths?

I just replied on the other thread. I think we interpreted "event" differently.

If we want to capture the working group name then we should use the full name, like:
http://schemas.openid.net/secevent/risc/event/account-deleted

maybe:

Marius

                                                                -- Mike

Marius

Phil

 — Justin

Phil

Thoughts?

Marius