Subject: [stir] Proposed JWT Constraints Syntax

From: Russ Housley <[email-masked]>
Date: Thu, 30 Mar 2017 11:10:23 -0400

JWTClaimConstraints ::= SEQUENCE {
   mustInclude [0] JWTClaimNames OPTIONAL,
      -- The listed claim names MUST appear in the PASSporT in addition to iat, orig, dest
      -- If absent, iat, orig, dest MUST appear in the PASSporT
   permittedValues [1] JWTClaimPermittedValuesList OPTIONAL }
      -- If the claim name is present, the claim MUST contain one of the listed values
    ( WITH COMPONENTS { ..., mustInclude PRESENT }
   | WITH COMPONENTS { ..., permittedValues PRESENT } )

JWTClaimPermittedValuesList SEQUENCE SIZE (1..MAX) OF JWTClaimPermittedValues
JWTClaimPermittedValues ::= SEQUENCE {
    claim  JWTClaimName,
    permitted  SEQUENCE SIZE (1..MAX) OF IA5String }

JWTClaimNames ::= SEQUENCE SIZE (1..MAX) OF JWTClaimName
JWTClaimName ::= IA5String

---

From: Russ Housley <[email-masked]>
Date: Thu, 30 Mar 2017 11:18:20 -0400

Based on the discussion in the room, the claim values should allow UTF8String, not just IA5String.

That change would result in:

JWTClaimPermittedValuesList SEQUENCE SIZE (1..MAX) OF JWTClaimPermittedValues
JWTClaimPermittedValues ::= SEQUENCE {
   claim  JWTClaimName,
   permitted  SEQUENCE SIZE (1..MAX) OF UTF8String }