Open ID Specification Work

Session Topic: Open ID Specification Work (TH3&4B)

Convener: Mike Jones

Notes-taker(s): Mike Jones

Tags for the session - technology discussed/ideas considered:

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

Thursday 11:30


 * George Fletcher
 * Breno de Medeiros
 * Pamela Dingle
 * Vikas Jain
 * Tony Nadalin
 * Michael Buck
 * John Bradley
 * Nat Sakimura
 * Mike Jones

These people joined us during the lunch hour, as work continued:
 * Dale Olds
 * John Panzer
 * Edmund Jay

We started with the topic of the schema for the UserInfo endpoint. Chuck Mortimore supplied this input data for the decision:

This is PoCo - also wire compatible with OpenSocial - http://portablecontacts.net/draft-schema.html

This is the early SCIM work. We based ours on PoCo - I'd like to make sure this is overlapped and wire compatible - http://www.simplecloud.info/

RPX normalizes all their providers to PoCo - https://rpxnow.com/docs#profile_data

Here's detail on how the data that the networks will actually return - https://rpxnow.com/docs/providers

Decision:  Don’t invent something new

Decision:  Adopt a subset of the Portable Contacts schema

Fields in basic set:
 * Display Name
 * Nickname
 * Full Name
 * Photo
 * e-Mail Address
 * URLs (typed, with types including “profile”, “blog”, etc.)
 * Data of Birth / Age
 * Equivalent of everything in SREG
 * Verified e-mail (verified other?)

Breno: could define a mechanism to ask about validation of claims (especially e-mail)

Mike:  Use claim(s) to express that e-mail and maybe other claims are verified

Decision:  Don’t change POCO e-mail format – add verification claim(s) that can be ignored if not understood

Decision:  Add “verified” into the POCO structure – parallel to “primary” Meta – time last modified Phone number

Breno:  May want to define second set of supplemental attributes that are not in basic set Address Organization

Rejected:
 * providerName – comes at the wrong point in the flow
 * preferred username

George:  Context and purpose form-fill for site registration

Observation:  POCO contains both fields about me and fields about what I know about others.

Decision:  We are only including fields that are about me.

Nat:  Need to extend to be able to represent information in multiple scripts

Nat has proposal for how to extend fields for multiple scripts Example:  http://axschema.org/namePerson#ja_Kana_JP
 * language_script_country
 * ISO639_ISO15924_ISO3166

Breno:  There is an ISO format for this – Nat and Breno will investigate

Decision:  Ignore information you don’t understand

Need to discuss “id”, PPID, ephemeral ID

SCIM “id” stable and omnidirectional

Breno:  “id” omnidirectional, stable, IdP-relative. Should not be returned if directional identifier in id_token.

Breno:  ID returned from userInfo endpoint should match the one in the id_token. If directional, call it “ppid”.

Decision:  Single “id” field, and also an ID Type field that can be ignored if not understood.

Defined ID Type values “omnidirectional”, “directional”. Other understood values MAY be used.

Breno:  For compatibility:  define “openid_identifier” field

Decision:  SCIM externalId, userName don’t make sense in this context