Subject: [Jwt-reg-review] Claims registration question

From: Bart Grantham <[email-masked]>
Date: Wed, 22 Apr 2015 22:14:17 +0000

A standards body that my company is involved in, the Global Alliance for Genomic Health (“GA4GH”), is looking at OAuth2/OpenID Connect for identity management amongst the various projects and it occurs to us that it may be necessary for the GA4GH to register domain-specific claims regarding researcher’s qualifications/membership in organizations.

I’m wondering if it’s possible for the GA4GH to claim, after appropriate discussion and review, a wildcard claim?  Something like org.genomicsandhealth.* ?  This would allow the GA4GH to internally manage the registration of claims that that are relavant to the organization (“org.genomicsandhealth.projects.beacon”, “org.genomicsandhealth.eu_commons”, etc.)

If this is not possible, is there an alternative to registering each and every claim name that arises with IANA?

--
Bart Grantham

---

From: John Bradley <[email-masked]>
Date: Thu, 23 Apr 2015 13:06:33 -0300

You can use public collision resistant names like http://genomicsandhealth.org/claims/value1 That also allows for the claim to be documented via the follow your nose principal.
https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.2

You could use that and then register them if there is a need for interoperability outside your community. 

If you established that pattern, it would be unlikely that anyone other than the owner of that namespace is going to register something in the registry that conflicts with you.

John B.
> On Apr 22, 2015, at 7:14 PM, Bart Grantham <[email-masked]> wrote:
> 
> _______________________________________________
> Jwt-reg-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jwt-reg-review

---

From: Brian Campbell <[email-masked]>
Date: Thu, 23 Apr 2015 10:29:20 -0600

Indeed org.genomicsandhealth.* itself also seems sufficiently
collision-resistant.

On Thu, Apr 23, 2015 at 10:06 AM, John Bradley <[email-masked]> wrote:

> You can use public collision resistant names like
> http://genomicsandhealth.org/claims/value1 That also allows for the claim
> to be documented via the follow your nose principal.
> If you established that pattern, it would be unlikely that anyone other
> than the owner of that namespace is going to register something in the
> registry that conflicts with you.
>
> John B.
> > A standards body that my company is involved in, the Global Alliance for
> Genomic Health (“GA4GH”), is looking at OAuth2/OpenID Connect for identity
> management amongst the various projects and it occurs to us that it may be
> necessary for the GA4GH to register domain-specific claims regarding
> researcher’s qualifications/membership in organizations.
> >
> > I’m wondering if it’s possible for the GA4GH to claim, after appropriate
> discussion and review, a wildcard claim?  Something like
> org.genomicsandhealth.* ?  This would allow the GA4GH to internally manage
> the registration of claims that that are relavant to the organization
> (“org.genomicsandhealth.projects.beacon”,
> “org.genomicsandhealth.eu_commons”, etc.)
> >

---

From: John Bradley <[email-masked]>
Date: Thu, 23 Apr 2015 13:48:22 -0300

It is collision resistant but is harder to self document without registration.  Using a URI pointing at the definition of the claim is a relatively well proven technique to prevent collisions.  
Both can work.

John B.

> On Apr 23, 2015, at 1:29 PM, Brian Campbell <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Indeed org.genomicsandhealth.* itself also seems sufficiently collision-resistant.
> 
> On Thu, Apr 23, 2015 at 10:06 AM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
> You can use public collision resistant names like http://genomicsandhealth.org/claims/value1 <http://genomicsandhealth.org/claims/value1> That also allows for the claim to be documented via the follow your nose principal.
> https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.2 <https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.2>
> 
> > On Apr 22, 2015, at 7:14 PM, Bart Grantham <[email-masked] <mailto:[email-masked]>> wrote:
> >
> > I’m wondering if it’s possible for the GA4GH to claim, after appropriate discussion and review, a wildcard claim?  Something like org.genomicsandhealth.* ?  This would allow the GA4GH to internally manage the registration of claims that that are relavant to the organization (“org.genomicsandhealth.projects.beacon”, “org.genomicsandhealth.eu <http://org.genomicsandhealth.eu/>_commons”, etc.)
> >
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/jwt-reg-review <https://www.ietf.org/mailman/listinfo/jwt-reg-review>
>