Please remove my email from the conversation Em ter., 22 de set. de 2020 às 03:25, Deepak Tiwari < [email protected]> escreveu:
> Please remove my email from the conversation > > On Tue, Sep 22, 2020 at 7:39 AM Logan Widick <[email protected]> > wrote: > >> If I understand "The intent would be to present that information in the >> same way you would when querying a users/<id>, encoded in claims" correctly, >> the "roles", "groups", and "entitlements" claims are the same types as the >> "roles", "groups", and "entitlements" attributes of the User resource >> schema (pages 24-25 of RFC 7643 for the text; pages 63-67 of RFC 7643 for >> the schema)? In the schema the attributes are all "complex" (object) type >> and "multivalued" (array of), although the text for some of these >> attributes has some "No vocabulary or syntax..." remarks. >> >> If that understanding is correct, it might be a good idea to replace the >> references to "RFC 7643", "Section 4.1.2 of RFC 7643", and "RFC 7643, >> Section 4.1.2" with something more specific like "the ____ attribute(s) of >> the User resource schema from Section 4.1.2 of RFC 7643". >> >> On Mon, Sep 21, 2020, 15:33 Brian Campbell <[email protected]> >> wrote: >> >>> At some point I'm going to be among the lucky few who will be asked to >>> review the JWT claims registration request. One of the criteria to consider >>> is "whether the registration description is clear" and Logan's questions >>> suggest that perhaps the descriptions of these claims are not sufficiently >>> clear. My assumption was that the claim value for "roles", "groups" and >>> "entitlements" was going to be an array of strings. Trying to validate my >>> assumption, I went looking at the text in >>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-2.2.3.1 >>> and >>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2 >>> and followed the reference to >>> https://tools.ietf.org/html/rfc7643#section-4.1.2 and, honestly, it >>> wasn't particularly clear to me. Maybe it's my lack of familiarity with the >>> details of SCIM and the language of RFC 7643. But I think that, for the >>> sake of clarity and interoperability, some additional specificity is >>> needed. >>> >>> Side note: the "Section 2.2.2.1 of [[this specification]]" references in >>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2.1 >>> are problmatic (there is no such section in this document) and probably >>> should be to 2.2.3.1. >>> >>> On Fri, Sep 18, 2020 at 6:28 PM Vittorio Bertocci <vittorio.bertocci= >>> [email protected]> wrote: >>> >>>> Hi Logan, >>>> >>>> Thanks for the note. >>>> >>>> The intent would be to present that information in the same way you >>>> would when querying a users/<id>, encoded in claims; hence groups would be >>>> a list of values representing what groups the subject belongs to, rather >>>> than a list of full group definitions (with all the other members belonging >>>> to them, for example) which would go beyond the intended use of the >>>> information (supplying authorization information about the subject). >>>> >>>> I tried to keep the language high level as I didn’t want to duplicate >>>> SCIM guidance, or inadvertently narrow down the options products have to >>>> implement this. If you think this is too vague, we can try to be more >>>> specific. >>>> >>>> >>>> >>>> *From: *OAuth <[email protected]> on behalf of Logan Widick < >>>> [email protected]> >>>> *Date: *Wednesday, September 16, 2020 at 14:21 >>>> *To: *"[email protected]" <[email protected]> >>>> *Subject: *[OAUTH-WG] draft-ietf-oauth-access-token-jwt-08 question >>>> >>>> >>>> >>>> I took a look at Section 2.2.3.1: Claims for Authorization Outside of >>>> Delegation Scenarios ( >>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-08#section-2.2.3.1) >>>> and I do not understand what exactly the formats of the "roles", "groups", >>>> and "entitlements" claims will be. >>>> >>>> Will the "roles" claim be an array of strings (role names, IDs, or >>>> links), an array of the "roles" objects from the SCIM User schema (pages >>>> 66-67 of RFC 7643), or something else? >>>> >>>> Will the "groups" claim be an array of strings (group names, IDs, or >>>> links), an array of the "groups" objects from the SCIM User schema (pages >>>> 63-64 of RFC 7643), an array of SCIM Group schema objects (pages 69-70 of >>>> RFC 7643), or something else? >>>> >>>> Will the "entitlements" claim be an array of strings (entitlement >>>> names, IDs, or links), an array of the "entitlements" objects from the SCIM >>>> User schema (pages 65-66 of RFC 7643), or something else? >>>> >>>> Sincerely, >>>> >>>> Logan Widick >>>> _______________________________________________ >>>> OAuth mailing list >>>> [email protected] >>>> https://www.ietf.org/mailman/listinfo/oauth >>>> >>> >>> *CONFIDENTIALITY NOTICE: This email may contain confidential and >>> privileged material for the sole use of the intended recipient(s). Any >>> review, use, distribution or disclosure by others is strictly prohibited. >>> If you have received this communication in error, please notify the sender >>> immediately by e-mail and delete the message and any file attachments from >>> your computer. Thank you.* >> >> _______________________________________________ >> OAuth mailing list >> [email protected] >> https://www.ietf.org/mailman/listinfo/oauth >> > > > -- > > Regards, > > *Deepak Tiwari|* Software Engineer > Intigate Technologies Pvt. Ltd. | www.intigate.co.in > Ist Floor, A-119 > Sector-63 > Noida (U.P.) 201301 > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > -- Att. Guilherme Ap. Sona Kun - Desenvolvimento
_______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
