Subject: Re: [Txauth] XYZ vs XAuth - 5 differences

From: Mike Jones <[email-masked]>
Date: Tue, 24 Mar 2020 18:35:00 +0000

Taking Leif's comment seriously, for the record, here's some of the historical context on why OpenID Connect created new short JSON claim names.  First, we actually did seriously consider reusing existing SAML attribute name URNs.  But at the time, developers were voting with their feet, rejecting XML and SOAP for JSON and REST, and we wanted the result to be something that developers would embrace.  

Also, remember that Facebook Connect already existed, which used short JSON claim names like "email" and "id".  At the time, Facebook was actively contributing to OpenID Connect and together we consciously embraced short simple claim names like those used in Facebook Connect, as developers seemed to like them.  But we created the IANA JSON Web Token Claims Registry to make them part of an open, extensible set of standards.

At least we were right that developers would gravitate towards the intentionally simple design OpenID Connect if they wanted a standards-based identity solution.  (See the large set of certified implementations at https://openid.net/certification/ as one data point quantifying this success.)  Yes, we could have done many things differently, but on the whole, the choices seem to have worked out well in the marketplace of ideas and implementations.

				Cheers,
				-- Mike

-----Original Message-----
From: Txauth <[email-masked]> On Behalf Of Leif Johansson
Sent: Tuesday, March 24, 2020 8:19 AM
To: [email-masked]
Subject: Re: [Txauth] Re: XYZ vs XAuth - 5 differences

On 2020-03-23 20:53, Mike Jones wrote:
> *I would prefer XAuth*as a starting point over XYZ because XAuth is clearly trying to reuse existing identity representations, whereas XYZ is creating a new one.
> 

I wish somebody would have made that argument in favor of reusing OID URNs from SAML in OIDC :-)

	Cheers Leif

-- 
Txauth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/txauth

---

From: David Waite <[email-masked]>
Date: Tue, 24 Mar 2020 13:41:55 -0600

> On Mar 24, 2020, at 12:35 PM, Mike Jones <Michael.Jones=[email-masked]> wrote:
> 

The simple registration claim names with OpenID 2 were also short text names, with a fair amount of overlap. Some changes like “dob” -> “birthdate” make me think this was subconscious, though.

-DW

---

From: Leif Johansson <[email-masked]>
Date: Tue, 24 Mar 2020 23:26:06 +0100

> Taking Leif's comment seriously, for the record, here's some of the historical context on why OpenID Connect created new short JSON claim names.  First, we actually did seriously consider reusing e…

It was meant to be taken sort of seriously.

Your description of history also shows how something as silly as "short" became
the primary design criterion for developing schema.

The fact that OIDC succeeded only means somebody is bound to do the same thing
all over again and one shouldn't point fingers is all I meant to say...

	Cheers Leif