Self-issued Identifier

Full Title or Meme

This Wiki Page was created to track the use of Self-issued Identifiers in the Open Identity Ecosystem.

Context

• This wiki is focused on the use case of a Self-issued Identifier in a mobile device. It is recognized that other use cases also exist, but it seems that this use case covers all the issues.
• With the rise of the W3C program on Decentralized Identifiers, there is a need for the Identity Ecosystem to coordinate with other teams developing this technology.
• At the 2020-06-16 meeting of the Kantara FIRE WG a liaison effort was approved. That effort is tracked here.
• At the 2020-06-18 meeting of the OpenID AB/C WG it seemed like a summary of the various points would help to reach a consensus approach.

History

• The [OpenID Connect Core 1.0 was issued on 2018-11-08 with section 7 covering self-issued ID. Initial uptake was minimal.
• The Subject ID (SUB) was redefined for that section as "the base64url encoded representation of the thumbprint of the key in the sub_jwk Claim. This thumbprint value is computed as the SHA-256 hash of the octets of the UTF-8 representation of a JWK constructed containing only the REQUIRED members to represent the key, with the member names sorted into lexicographic order, and with no white space or line breaks."
• An issued was imported from FAPI to AB/C on 2019-05-03 about the Need for a persistence user identifier - a PUID that was not pursued.
• On 2019-05-06 a related issue was posted on "Core - Section 8. Need more subject_type" to distinguish between ephemeral and persistent keys was raised (as an ID type) and not pursued.
• Recently the DIF posted Self-Issued OpenID Connect Provider DID Profile which leaves the issue of sub alone and create a new field for the DID only.
• On 2020-06-06 a proposal was posted to "Create a Separate Spec for Self-Issued Identifiers" that would address the issues about sub and a persistent ID in the context of the problem of key recovery, reissue and roll-over while giving the user a better experience with OpenID Connect.

Problems

• The current work of the Decentralized Identifiers has proceed with little concern for how it might interoperate with existing Identity Ecosystems.
• The DIF SIOP spec creates a new fields for identifiers rather than fit within a common field that would promote interoperability with other methods.
• Self-issued Identifiers of all types depend on secret values held by the user in portable protected storage, for example a smartphone or WebAuthn key.
• If the user's hardware device is stolen or disabled, the recovery of the user's identifier can be a challenge which could turn into a UX nightmare if not handled well.
• In particular the SIOP program has been developing standards which look a lot like the DIA and other work in the Kantara work groups without any coordination.
• The current draft of the Kantara FIRE DIA spec treats the sub field as a random GUID to assure uniqueness.

Solutions

1. The Subject ID (sub) could be freed from the limitations described the core spec above and take its traditional unstructured format. This would allow it to take on any form, like that of a DID.
2. The Persistent User ID (puid) could be made mandatory in a new spec that included other information on the need for key recovery, reissue and roll-over. Those processes would be spelled out in some detail.
   1. Any new identifier format (like the DID) should fit within the definition of this field as would new or propriety methods.
   2. The id_token could be further described for optional Client Bound End-User Assertion (see reference below) in place of the traditional Bearer Token.

References

• Client Bound End-User Assertion
• Self-Issued OpenID Connect Provider DID Profile of the Decentralized Identifier Foundation.
• another wiki page on Self-issued ID
• wiki page on Self-issued OpenID Provider
• wiki page on Self-Sovereign Identity
• Using OpenID Connect Self-Issued to Achieve DID Auth from Mike Jones
• Who is the special openid connect url issued to and is it a risk? http://self-issued.me