Subject: Re: [Jwt-reg-review] Request to register claim: permissions

From: Eve Maler <[email-masked]>
Date: Sun, 23 Jul 2017 17:01:57 -0700

Hi Brian-- The Work Group has discussed this, and decided to rescind our
registration request. Thanks very much for your time and feedback. We may
come back at a later date with something more fully considered.

*Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology
Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

On Wed, Jun 28, 2017 at 1:24 PM, Brian Campbell <[email-masked]>
wrote:

> Hi Eve,
>
> I think a bit more revision work on the document is needed before this
> request to register the 'permissions' JWT claim can be sent to IANA.
>
> Section 5 kind of sort of implies the possible use of JWT in saying,
> "Validate the RPT locally if it is self-contained" but otherwise JWT isn't
> mentioned in the document at all other than the IANA request in Section
> 9.2. (which cites [OIDCCore] regarding JWT claim registration rather than
> RFC 7519 that it should be - see https://tools.ietf.org/html/rf
> c7800#section-6.1 for an example).  For that matter RFC 7519, which
> defines JSON Web Token and established the claims registry, isn't even
> referenced in the document.
>
> Section 5.1.1
> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
> is about the 'permissions' parameter in the Token Introspection response.
> While there are similarities in how they sometimes are used, the
> introspection response parameters and JWT claims are distinct and different
> things. Sec 5.1.1. can't be said to define a JWT claim. At the least, I
> would expect some definition of the 'permissions' claim in JWT even if it
> just cites the introspection response parameter and says it means the same
> thing but is a claim in a self-contained JWT. I'm guessing that was more or
> less the intent. But that's a lot of inferring and I believe a
> specification and IANA registration need to be more explicit.
>
>
>
>
>
> On Fri, Jun 16, 2017 at 6:41 PM, Eve Maler <[email-masked]>
> wrote:
>
>> As required by RFC 7519 Section 10.1, the authors of the specification Federated
>> Authorization for User-Managed Access (UMA) 2.0
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html>  are
>> requesting to register the following claim:
>>
>>    - permissions
>>
>> The claim definition appears in Section 5.1.1
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#uma-bearer-token-profile>.
>> The IANA request appears in Section 9.2
>> <https://docs.kantarainitiative.org/uma/wg/oauth-uma-federated-authz-2.0-05.html#rfc.section.9.2>
>> .
>>
>> Thank you. We look forward to your response.
>>
>>
>> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging
>> Technology
>> Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter:
>> @xmlgrrl
>>
>> _______________________________________________
>> Jwt-reg-review mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/jwt-reg-review
>>
>>
>
>
> --
> <https://www.pingidentity.com>
> <https://www.pingidentity.com>
> Brian Campbell
> Distinguished Engineer
> [email-masked]
> w: +1 720.317.2061 <(720)%20317-2061>
> c: +1 303.918.9415 <(303)%20918-9415>
> Connect with us: 
> <https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm> [image:
> LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
> logo] <https://twitter.com/pingidentity> 
> <https://www.facebook.com/pingidentitypage> 
> <https://www.youtube.com/user/PingIdentityTV> 
> <https://plus.google.com/u/0/114266977739397708540> 
> <https://www.pingidentity.com/en/blog.html>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*

---

From: Brian Campbell <[email-masked]>
Date: Mon, 24 Jul 2017 12:50:33 +0200

Thanks for the update, Eve.

On Mon, Jul 24, 2017 at 2:01 AM, Eve Maler <[email-masked]> wrote:

> On Wed, Jun 28, 2017 at 1:24 PM, Brian Campbell <
> [email-masked]> wrote:
>
>> Hi Eve,
>>

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*