Open ID Specification Work

From IIW

Session Topic: Open ID Specification Work (TH3&4B)

Convener: Mike Jones

Notes-taker(s): Mike Jones

Tags for the session - technology discussed/ideas considered:

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

Thursday 11:30

  • George Fletcher
  • Breno de Medeiros
  • Pamela Dingle
  • Vikas Jain
  • Tony Nadalin
  • Michael Buck
  • John Bradley
  • Nat Sakimura
  • Mike Jones

These people joined us during the lunch hour, as work continued:

  • Dale Olds
  • John Panzer
  • Edmund Jay

We started with the topic of the schema for the UserInfo endpoint.  Chuck Mortimore supplied this input data for the decision:

This is PoCo - also wire compatible with OpenSocial -

This is the early SCIM work.   We based ours on PoCo - I'd like to make sure this is overlapped and wire compatible -

RPX normalizes all their providers to PoCo -

Here's detail on how the data that the networks will actually return -

Decision:  Don’t invent something new

Decision:  Adopt a subset of the Portable Contacts schema

Fields in basic set:

  •                Display Name
  •                Nickname
  •                Full Name
  •                Photo
  •                e-Mail Address
  •                URLs (typed, with types including “profile”, “blog”, etc.)
  •                Data of Birth / Age
  •                Equivalent of everything in SREG
  •                Verified e-mail (verified other?)

                              Breno: could define a mechanism to ask about validation of claims (especially e-mail)

                              Mike:  Use claim(s) to express that e-mail and maybe other claims are verified                              

Decision:  Don’t change POCO e-mail format – add verification claim(s) that can be ignored if not understood

                              Decision:  Add “verified” into the POCO structure – parallel to “primary”                Meta – time last modified                Phone number

Breno:  May want to define second set of supplemental attributes that are not in basic set                Address                Organization


  •                providerName – comes at the wrong point in the flow
  •                preferred username

George:  Context and purpose form-fill for site registration

Observation:  POCO contains both fields about me and fields about what I know about others.

Decision:  We are only including fields that are about me.

Nat:  Need to extend to be able to represent information in multiple scripts

Nat has proposal for how to extend fields for multiple scripts

  •                language_script_country
    •                               ISO639_ISO15924_ISO3166


Breno:  There is an ISO format for this – Nat and Breno will investigate

Decision:  Ignore information you don’t understand

Need to discuss “id”, PPID, ephemeral ID

SCIM “id” stable and omnidirectional

Breno:  “id” omnidirectional, stable, IdP-relative.  Should not be returned if directional identifier in id_token.

Breno:  ID returned from userInfo endpoint should match the one in the id_token.  If directional, call it “ppid”.

Decision:  Single “id” field, and also an ID Type field that can be ignored if not understood.

Defined ID Type values “omnidirectional”, “directional”.  Other understood values MAY be used.

Breno:  For compatibility:  define “openid_identifier” field

Decision:  SCIM externalId, userName don’t make sense in this context