Subject: [Id-event] Java library for Subject Identifiers

From: Matt Domsch <[email-masked]>
Date: Fri, 7 May 2021 21:31:26 +0000

Last week on the OpenID Shared Signals & Events call I walked through the openid-sse-model Java code I had created to make it easy to create and parse/consume SSE events. Annabelle asked if I could split the Subject Identifiers work out into a separate library, which I have now done.

https://github.com/sailpoint-oss/ietf-subject-identifiers-model has just Subject Identifiers in it.
https://github.com/sailpoint-oss/openid-sse-model uses Subject Identifiers, and adds SSE/CAEP/RISC event definitions and SET parsing.

These are now also published to Maven Central under group com.sailpoint.

Feedback, use in your projects, and patches welcome.

Thanks,
Matt

Matt Domsch
VP, Engineering Fellow
[email-masked]<mailto:[email-masked]>
mobile: 512-981-6486
www.sailpoint.com<http://www.sailpoint.com/>

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 9 May 2021 12:23:19 +0300

Hi Matt,

Thank you for implementing the draft!

Looking at the model, you have this comment (and associated code): “Subject Identifiers can be complex (thus recursive)”. This is not quite how I read the draft. The draft does not say that any future defined ID formats must not be recursive (and maybe it should), but all currently defined formats are flat, and for “alias” the document specifically says that identifiers must not be nested.

What did I miss?

Thanks,

Yaron

From: Matt Domsch <matt.domsch=[email-masked]>
Date: Saturday, May 8, 2021 at 00:31
To: [email-masked] <[email-masked]>
Subject: [Id-event] Java library for Subject Identifiers

Thanks,

Matt

Matt Domsch
VP, Engineering Fellow
[email-masked]

mobile: 512-981-6486
www.sailpoint.com

---

From: Matt Domsch <[email-masked]>
Date: Mon, 10 May 2021 22:00:20 +0000

Yaron, thanks for looking so quickly.   There are two aspects around recursiveness to be addressed.

  1.  You are correct that all of the subject identifiers except aliases defined in the spec  today are flat, and aliases explicitly say they cannot be recursive.  I have since added code (in a branch) to ensure aliases cannot be recursive (or if you do hand us one as a JSON String, it fails validation).  Furthermore, when parsing a JSON string into a tree of specific SIs, I don’t let those go recursive either.
  2.  OpenID Shared Signals and Events WG defines Complex Subject Identifiers [1] which are the AND of a set of simple subject identifiers that scope a subject or principal to a specific instance  (e.g. a user AND device).   Hence the parser here identifies complex subjects as a set of recursive single subjects.  I accomplished this by making the base SubjectIdentifier class here handle that recursion.  It may be cleaner if the SI spec doesn’t need (or want) recursion to move that functionality back into the openid-sse-model code from whence it came.  Thoughts?

Thanks,
Matt

[1] https://bitbucket.org/openid/risc/src/master/openid-sse-framework-1_0.txt section 3.2

Matt Domsch
VP, Engineering Fellow

From: Id-event <[email-masked]> On Behalf Of Yaron Sheffer
Sent: Sunday, May 9, 2021 4:23 AM
To: Matt Domsch <matt.domsch=[email-masked]>; [email-masked]
Subject: Re: [Id-event] Java library for Subject Identifiers

Hi Matt,

What did I miss?

Thanks,
                Yaron