Claims optionality and profiles about eat

[nedmsmith]

Verifier policies ultimately determine which claims matter and how to respond appropriately. Saying "all claims are optional" is different from saying "all claims not understood by implementations MUST be ignored". The latter potentially contradicts verifier policy that may NOT wish to process unknown claims as these may have obligatory requirements to protecting the confidentiality or integrity.

Definition of Verifier policies may be out of scope for RATS, though it should be anticipated that Verifiers have them.

[SimonFrost-Arm]

The intent of proposing the use of a referenced profile in draft-tschofenig-rats-psa-token is that it would be a description of the rules applied by the attesting implementation to the production of the EAT. A verifier would use this document to understand how to implement sufficient verification. The document would be normally be human readable rather than machine readable, though the latter case is not eliminated.
The profile will contain a full description of the standard claims and custom claims included, their usage (incl optionality), expected token signing, and any any verification specifics e.g. token structure such as submod usage.

[laurencelundblade]

CWT text seems pretty good:

Specific applications of CWTs will require implementations to
understand and process some claims in particular ways. However, in
the absence of such requirements, all claims that are not understood
by implementations MUST be ignored.

[SimonFrost-Arm]

I agree that the CWT text makes sense.
In trying to answer your queries posed in the initial Issue it seems to raise the question of whether there should be a mechanism for an implementation to declare the exact nature of its operation. What I probably should have added to my comment above is the suggestion that EAT should include a standard claim for 'profile' which would support such a mechanism. Previously that seemed supplementary to this specific issue but I'm not sure by what other form of submission you would like that proposal?

[laurencelundblade]

We can close this because there is consensus that the CWT and JWT text for optionality is fine and because there is a separate issue for profiles, #32

[laurencelundblade]

#121 is needed to address this. The CWT wording is short but critically addressed Ned's point above.

[laurencelundblade]

Fixed by #121