Subject: [OAUTH-WG] The use of sub in POP-02

From: Nat Sakimura <[email-masked]>
Date: Mon, 23 Mar 2015 16:25:13 +0900

Re:
https://tools.ietf.org/html/draft-ietf-oauth-proof-of-possession-02#section-3

I understand the use of sub in this section comes down from SAML but I feel
that some separation between sub and presenter would be nice.

For example, when I am presenting the token using an app that I installed
on my iPhone, the presenter is that app and not me, while the sub still may
be me. The app is the authorized presenter/party (azp) of the token.

So my proposal is to use a claim like "azp" instead of "sub" to identify
the presenter. Less overload would cause less confusion later, IMHO.

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 23 Mar 2015 08:29:44 +0100

+1

sounds reasonable to distinguish the software and the user.

Am 23. März 2015 08:25:13 MEZ, schrieb Nat Sakimura <[email-masked]>:
>------------------------------------------------------------------------
>
>_______________________________________________
>OAuth mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/oauth

-- 
Diese Nachricht wurde von meinem Android-Mobiltelefon mit K-9 Mail gesendet.

---

From: Brian Campbell <[email-masked]>
Date: Mon, 23 Mar 2015 09:05:44 -0500

+1

The JWT may well be about the sub but presented by some software component
that should be independently identified.

On Mon, Mar 23, 2015 at 2:25 AM, Nat Sakimura <[email-masked]> wrote:

> I understand the use of sub in this section comes down from SAML but I
> feel that some separation between sub and presenter would be nice.
>