Subject: Re: [Id-event] Security Event Token (SET) spec simplifying claims usage

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 5 Feb 2018 17:27:48 +0000

Thanks, Mike.

With these latest changes, I believe that we can make the current draft work for RISC. It will require doing more within the RISC Profile than at least I was expecting, and the result will likely be incompatible with most/all other SET profiles, but it will work for us.

--
Annabelle Richard Backman
Amazon – Identity Services

From: Id-event <[email-masked]> on behalf of Mike Jones <[email-masked]>
Date: Friday, February 2, 2018 at 5:41 PM
To: SecEvent <[email-masked]>
Subject: [Id-event] Security Event Token (SET) spec simplifying claims usage

The Security Event Token (SET) specification has been updated to simplify the definitions and usage of the “iat” (issued at) and “toe” (time of event) claims.  The full set of changes made was:

  *   Simplified the definitions of the “iat” and “toe” claims in ways suggested by Annabelle Backman.
  *   Added privacy considerations text suggested by Annabelle Backman.
  *   Updated the RISC event example, courtesy of Marius Scurtescu.
  *   Reordered the claim definitions to place the required claims first.
  *   Changed to using the RFC 8174 boilerplate instead of the RFC 2119 boilerplate.

Thanks to Annabelle Backman, Marius Scurtescu, Phil Hunt, and Dick Hardt for the discussions that led to these simplifications.

The specification is available at:

  *   https://tools.ietf.org/html/draft-ietf-secevent-token-05

An HTML-formatted version is also available at:

  *   http://self-issued.info/docs/draft-ietf-secevent-token-05.html

                                                                -- Mike

P.S.  This announcement was also posted at http://self-issued.info/?p=1773 and as @selfissued<https://twitter.com/selfissued>.

---

From: Marius Scurtescu <[email-masked]>
Date: Mon, 5 Feb 2018 10:17:59 -0800

On Mon, Feb 5, 2018 at 9:27 AM, Richard Backman, Annabelle <
[email-masked]> wrote:

> Thanks, Mike.
>
>
>
> With these latest changes, I believe that we can make the current draft
> work for RISC. It will require doing more within the RISC Profile than at
> least I was expecting, and the result will likely be incompatible with
> most/all other SET profiles, but it will work for us.
>

Agreed, RISC can move forward.

Also sharing the profile compatibility concerns and the fact that we are
forcing duplication across profiles. Hopefully we will find ways to work
around these issues.

> *From: *Id-event <[email-masked]> on behalf of Mike Jones <
> [email-masked]>
> *Date: *Friday, February 2, 2018 at 5:41 PM
> *To: *SecEvent <[email-masked]>
> *Subject: *[Id-event] Security Event Token (SET) spec simplifying claims
> usage
>
>
>
> The Security Event Token (SET) specification has been updated to simplify
> the definitions and usage of the “iat” (issued at) and “toe” (time of
> event) claims.  The full set of changes made was:
>
>    - Simplified the definitions of the “iat” and “toe” claims in ways
>    suggested by Annabelle Backman.
>    - Added privacy considerations text suggested by Annabelle Backman.
>    - Updated the RISC event example, courtesy of Marius Scurtescu.
>    - Reordered the claim definitions to place the required claims first.
>    - Changed to using the RFC 8174 boilerplate instead of the RFC 2119
>    boilerplate.
>
>
>
> Thanks to Annabelle Backman, Marius Scurtescu, Phil Hunt, and Dick Hardt
> for the discussions that led to these simplifications.
>
>
>
>    - https://tools.ietf.org/html/draft-ietf-secevent-token-05
>
>
>
>    - http://self-issued.info/docs/draft-ietf-secevent-token-05.html
>
>
>
>                                                                 -- Mike
>
>
>
> P.S.  This announcement was also posted at http://self-issued.info/?p=1773
> and as @selfissued <https://twitter.com/selfissued>.
>
>
>
> _______________________________________________
> Id-event mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/id-event
>
>

---

From: Luke Camery <[email-masked]>
Date: Mon, 05 Feb 2018 18:36:16 +0000

I'm really happy to see a solid spec as the result of many discussions.
LGTM on this draft.

On Mon, Feb 5, 2018 at 10:18 AM Marius Scurtescu <[email-masked]>
wrote:

>> P.S.  This announcement was also posted at
>> http://self-issued.info/?p=1773 and as @selfissued
>> <https://twitter.com/selfissued>.
>>
>>
>>

-- 

*  •  **Luke Camery*
*  •  *Associate Product Manager
*  •  *Federated Identity

---

From: Adam Dawes <[email-masked]>
Date: Mon, 5 Feb 2018 16:00:16 -0800

I support the current draft for RISC.

On Mon, Feb 5, 2018 at 10:36 AM, Luke Camery <[email-masked]> wrote:

>>> *Subject: *[Id-event] Security Event Token (SET) spec simplifying
>>> claims usage
>>>
>>>
>>>
>>> The Security Event Token (SET) specification has been updated to
>>> simplify the definitions and usage of the “iat” (issued at) and “toe”
>>> (time of event) claims.  The full set of changes made was:
>>>
>>> P.S.  This announcement was also posted at http://self-issued.info/?p=
>>> 1773 and as @selfissued <https://twitter.com/selfissued>.
>>>
>>>
>>>

-- 
Adam Dawes | Sr. Product Manager | [email-masked] | +1 650-214-2410