Entity Statement - Revision history

Tomjones: /* Entity Statement from OpenID */

2019-09-28T04:14:51Z

Entity Statement from OpenID

← Older revision		Revision as of 04:14, 28 September 2019
Line 26:		Line 26:
	crit<blockquote>OPTIONAL. The crit (critical) entity statement claim indicates that extensions to entity statement claims defined by this specification are being used that MUST be understood and processed. It is used in the same way that crit is used for extension JWS header parameters that MUST be understood and processed. Its value is an array listing the entity statement claims present in the entity statement that use those extensions. If any of the listed extension entity statement claims are not understood and supported by the recipient, then the entity statement is invalid. Producers MUST NOT include entity statement claim names defined by this specification or names that do not occur as entity statement claim names in the entity statement in the crit list. Producers MUST NOT use the empty list [] as the crit value.</blockquote>		crit<blockquote>OPTIONAL. The crit (critical) entity statement claim indicates that extensions to entity statement claims defined by this specification are being used that MUST be understood and processed. It is used in the same way that crit is used for extension JWS header parameters that MUST be understood and processed. Its value is an array listing the entity statement claims present in the entity statement that use those extensions. If any of the listed extension entity statement claims are not understood and supported by the recipient, then the entity statement is invalid. Producers MUST NOT include entity statement claim names defined by this specification or names that do not occur as entity statement claim names in the entity statement in the crit list. Producers MUST NOT use the empty list [] as the crit value.</blockquote>
	policy_language_crit<blockquote>OPTIONAL. The policy_language_crit (critical) entity statement claim indicates that extensions to the policy language defined by this specification are being used that MUST be understood and processed. It is used in the same way that crit is used for extension JWS header parameters that MUST be understood and processed. Its value is an array listing the policy language extensions present in the policy language statements that use those extensions. If any of the listed extension policy language extensions are not understood and supported by the recipient, then the entity statement is invalid. Producers MUST NOT include policy language names defined by this specification or names that do not occur in policy language statements in the entity statement in the policy_language_crit list. Producers MUST NOT use the empty list [] as the policy_language_crit value.</blockquote>		policy_language_crit<blockquote>OPTIONAL. The policy_language_crit (critical) entity statement claim indicates that extensions to the policy language defined by this specification are being used that MUST be understood and processed. It is used in the same way that crit is used for extension JWS header parameters that MUST be understood and processed. Its value is an array listing the policy language extensions present in the policy language statements that use those extensions. If any of the listed extension policy language extensions are not understood and supported by the recipient, then the entity statement is invalid. Producers MUST NOT include policy language names defined by this specification or names that do not occur in policy language statements in the entity statement in the policy_language_crit list. Producers MUST NOT use the empty list [] as the policy_language_crit value.</blockquote>
	The entity statement is signed using the private key of the issuer entity, in the form of a JSON Web Signature (JWS).~~</blockquote>~~		The entity statement is signed using the private key of the issuer entity, in the form of a JSON Web Signature (JWS).

	The following is a non-normative example of an entity statement, before serialization and adding a signature. The example contains a critical extension jti (JWT ID) to the entity statement and one critical extension to the policy language regexp (Regular expression).		The following is a non-normative example of an entity statement, before serialization and adding a signature. The example contains a critical extension jti (JWT ID) to the entity statement and one critical extension to the policy language regexp (Regular expression).

Tomjones: /* Entity Statement from OpenID */

2019-09-28T04:13:43Z

Entity Statement from OpenID

← Older revision		Revision as of 04:13, 28 September 2019
Line 20:		Line 20:
	exp<blockquote>REQUIRED. Expiration time on or after which the statement MUST NOT be accepted for processing. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.</blockquote>		exp<blockquote>REQUIRED. Expiration time on or after which the statement MUST NOT be accepted for processing. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.</blockquote>
	jwks<blockquote>REQUIRED. A JSON Web Key Set (JWKS) representing the public part of the subject entity's signing keys. The corresponding private key is used by leaf entities to sign entity statements about themselves, and intermediate entities to sign statements about other entities. The keys that can be found here are primarily intended to sign entity statements and should not be used in other protocols.</blockquote>		jwks<blockquote>REQUIRED. A JSON Web Key Set (JWKS) representing the public part of the subject entity's signing keys. The corresponding private key is used by leaf entities to sign entity statements about themselves, and intermediate entities to sign statements about other entities. The keys that can be found here are primarily intended to sign entity statements and should not be used in other protocols.</blockquote>
	aud<blockquote>OPTIONAL. The entity statement may be specifically created for a entity. The entity identifier for that entity should appear in this claim.		aud<blockquote>OPTIONAL. The entity statement may be specifically created for a entity. The entity identifier for that entity should appear in this claim.</blockquote>
	authority_hints<blockquote>OPTIONAL. A JSON object where the keys are the entity IDs of the intermediate entities that may issue an entity statement about the issuer entity. The value MUST be a JSON array of entities that are further up in the trust chain. The array may be an empty list. The JSON array can be used to simplify the selection of trust chains without the need for following all possible trust chains. authority_hints values may be multiple hops up the chain. These values will typically be trust anchors.</blockquote>		authority_hints<blockquote>OPTIONAL. A JSON object where the keys are the entity IDs of the intermediate entities that may issue an entity statement about the issuer entity. The value MUST be a JSON array of entities that are further up in the trust chain. The array may be an empty list. The JSON array can be used to simplify the selection of trust chains without the need for following all possible trust chains. authority_hints values may be multiple hops up the chain. These values will typically be trust anchors.</blockquote>
	metadata<blockquote>OPTIONAL. JSON object including protocol specific metadata claims that represent the entity's metadata. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata according to the metadata schema of that metadata type. An entity statement may contain multiple metadata statements, but only one for each metadata type.</blockquote>		metadata<blockquote>OPTIONAL. JSON object including protocol specific metadata claims that represent the entity's metadata. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata according to the metadata schema of that metadata type. An entity statement may contain multiple metadata statements, but only one for each metadata type.</blockquote>

Tomjones: /* Entity Statement from OpenID */

2019-09-28T04:13:02Z

Entity Statement from OpenID

← Older revision		Revision as of 04:13, 28 September 2019
Line 21:		Line 21:
	jwks<blockquote>REQUIRED. A JSON Web Key Set (JWKS) representing the public part of the subject entity's signing keys. The corresponding private key is used by leaf entities to sign entity statements about themselves, and intermediate entities to sign statements about other entities. The keys that can be found here are primarily intended to sign entity statements and should not be used in other protocols.</blockquote>		jwks<blockquote>REQUIRED. A JSON Web Key Set (JWKS) representing the public part of the subject entity's signing keys. The corresponding private key is used by leaf entities to sign entity statements about themselves, and intermediate entities to sign statements about other entities. The keys that can be found here are primarily intended to sign entity statements and should not be used in other protocols.</blockquote>
	aud<blockquote>OPTIONAL. The entity statement may be specifically created for a entity. The entity identifier for that entity should appear in this claim.		aud<blockquote>OPTIONAL. The entity statement may be specifically created for a entity. The entity identifier for that entity should appear in this claim.
	authority_hints<blockquote>OPTIONAL. A JSON object where the keys are the entity IDs of the intermediate entities that may issue an entity statement about the issuer entity. The value MUST be a JSON array of entities that are further up in the trust chain. The array may be an empty list. The JSON array can be used to simplify the selection of trust chains without the need for following all possible trust chains. authority_hints values may be multiple hops up the chain. These values will typically be trust anchors.		authority_hints<blockquote>OPTIONAL. A JSON object where the keys are the entity IDs of the intermediate entities that may issue an entity statement about the issuer entity. The value MUST be a JSON array of entities that are further up in the trust chain. The array may be an empty list. The JSON array can be used to simplify the selection of trust chains without the need for following all possible trust chains. authority_hints values may be multiple hops up the chain. These values will typically be trust anchors.</blockquote>
	metadata<blockquote>OPTIONAL. JSON object including protocol specific metadata claims that represent the entity's metadata. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata according to the metadata schema of that metadata type. An entity statement may contain multiple metadata statements, but only one for each metadata type.</blockquote>		metadata<blockquote>OPTIONAL. JSON object including protocol specific metadata claims that represent the entity's metadata. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata according to the metadata schema of that metadata type. An entity statement may contain multiple metadata statements, but only one for each metadata type.</blockquote>
	metadata_policy<blockquote>OPTIONAL. JSON object that describes a metadata policy. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata policy according to the metadata schema of that metadata type. An entity statement may contain multiple metadata policy statements, but only one for each metadata type. If the metadata type identifier is federation_entity, then the policy MUST be applied to the immediate subordinate in the trust chain unless that is a leaf entity. If the metadata type identifier is not federation_entity, then the policy MUST be applied to all subordinate nodes of that type in the trust chain. Only non-leaf entities contain a metadata_policy field.</blockquote>		metadata_policy<blockquote>OPTIONAL. JSON object that describes a metadata policy. Each key of the JSON object represents a metadata type identifier, and each value MUST be a JSON object representing the metadata policy according to the metadata schema of that metadata type. An entity statement may contain multiple metadata policy statements, but only one for each metadata type. If the metadata type identifier is federation_entity, then the policy MUST be applied to the immediate subordinate in the trust chain unless that is a leaf entity. If the metadata type identifier is not federation_entity, then the policy MUST be applied to all subordinate nodes of that type in the trust chain. Only non-leaf entities contain a metadata_policy field.</blockquote>

Tomjones: /* Solutions */

2019-09-28T04:11:39Z

Solutions

@@ Line 12: / Line 12: @@
 # To be fully compliant with the various [[Privacy]] legislation like the [[GDPR]] or the California legislation the [[Relying Party]] may first require that the user establish a channel back to the user for the performance of required [[Redress]] and [[Recovery]] operations.
 # Only then should the [[Relying Party]] be in a position to request additional [[Attribute]]s from the [[User]].
 ==References==

Tomjones: /* Problems */

2019-04-30T21:18:45Z

Problems

← Older revision		Revision as of 21:18, 30 April 2019
Line 6:		Line 6:

	==Problems==		==Problems==
	* Best method for establishing trust with a web site today in the [[EV Cert]] which is designed to bind the web site to a real world entity.		* Best method for establishing trust with a web site today in the [[EV Cert 1.1\|EV Cert]] which is designed to bind the web site to a real world entity.

	==Solutions==		==Solutions==

Tomjones: /* Full Title or Meme */

2019-04-30T21:18:03Z

Full Title or Meme

← Older revision		Revision as of 21:18, 30 April 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	An https://tcwiki.azurewebsites.net/index.php?title=Attested Attestation] statement about the [https://tcwiki.azurewebsites.net/index.php?title=Trusted_Identifier Trusted Identifier] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].		An [https://tcwiki.azurewebsites.net/index.php?title=Attested Attestation] statement about the [https://tcwiki.azurewebsites.net/index.php?title=Trusted_Identifier Trusted Identifier] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].

	==Preconditions==		==Preconditions==

Tomjones: /* Full Title or Meme */

2019-04-30T21:17:42Z

Full Title or Meme

← Older revision		Revision as of 21:17, 30 April 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	An [[Attestation]] statement about the [https://tcwiki.azurewebsites.net/index.php?title=Trusted_Identifier Trusted Identifier] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].		An https://tcwiki.azurewebsites.net/index.php?title=Attested Attestation] statement about the [https://tcwiki.azurewebsites.net/index.php?title=Trusted_Identifier Trusted Identifier] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].

	==Preconditions==		==Preconditions==

Tomjones: /* Full Title or Meme */

2019-04-30T21:15:49Z

Full Title or Meme

← Older revision		Revision as of 21:15, 30 April 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	An [[Attestation]] statement about the [[Trusted Identifier]] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].		An [[Attestation]] statement about the [https://tcwiki.azurewebsites.net/index.php?title=Trusted_Identifier Trusted Identifier] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].

	==Preconditions==		==Preconditions==

Tomjones: /* Full Title or Meme */

2019-04-30T21:10:31Z

Full Title or Meme

← Older revision		Revision as of 21:10, 30 April 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	An [[Attestation]] statement about the [[Trusted Identifier]] of the [[Entity]] typically from a [[Federation Operator]].		An [[Attestation]] statement about the [[Trusted Identifier]] of the [[Entity]] typically from a [[Trust_Framework_Membership_Validation#Federation_Operator\|Federation Operator]].

	==Preconditions==		==Preconditions==

Tomjones: /* Full Title or Meme */

2019-04-27T21:25:03Z

Full Title or Meme

← Older revision		Revision as of 21:25, 27 April 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	An [[Attestation]] statement about the [[Trusted Identifier]] of the [[Entity]] typically from a [[Federation Operator]].		An [[Attestation]] statement about the [[Trusted Identifier]] of the [[Entity]] typically from a [[Federation Operator]].

			==Preconditions==
			* The primary use case for the [[Entity Statement]] is a user navigating to the web site where they need be able to trust the site with their [[User Private Information]].

			==Problems==
			* Best method for establishing trust with a web site today in the [[EV Cert]] which is designed to bind the web site to a real world entity.

			==Solutions==
			# Users can [[Authentication\|Authenticate]] in a manner that gives a [[Relying Party]] a consistent [[Identifier]] that can be sued from session to session without the need for sharing any [[User Private Information]].
			# To be fully compliant with the various [[Privacy]] legislation like the [[GDPR]] or the California legislation the [[Relying Party]] may first require that the user establish a channel back to the user for the performance of required [[Redress]] and [[Recovery]] operations.
			# Only then should the [[Relying Party]] be in a position to request additional [[Attribute]]s from the [[User]].

			==References==
			*[https://www.federalregister.gov/documents/2018/11/14/2018-24714/developing-a-privacy-framework NIST Request for Information]


			[[Category:Glossary]]
			[[Category:Profile]]