Self-issued Identifier: Difference between revisions

Revision as of 23:27, 25 July 2020

This Wiki Page was created to track the use of Self-issued Identifiers in the Open Identity Ecosystem.

This wiki is focused on the use case of a Self-issued Identifier in a mobile device. It is recognized that other use cases also exist, but it seems that this use case covers all the issues.
With the rise of the W3C program on Decentralized Identifiers, there is a need for the Identity Ecosystem to coordinate with other teams developing this technology.
At the 2020-06-16 meeting of the Kantara FIRE WG a liaison effort was approved. That effort is tracked here.
At the 2020-06-18 meeting of the OpenID AB/C WG it seemed like a summary of the various points would help to reach a consensus approach.

The [OpenID Connect Core 1.0 was issued on 2018-11-08 with section 7 covering self-issued ID. Initial uptake was minimal.
The Subject ID (SUB) was redefined for that section as "the base64url encoded representation of the thumbprint of the key in the sub_jwk Claim. This thumbprint value is computed as the SHA-256 hash of the octets of the UTF-8 representation of a JWK constructed containing only the REQUIRED members to represent the key, with the member names sorted into lexicographic order, and with no white space or line breaks."
An issued was imported from FAPI to AB/C on 2019-05-03 about the Need for a persistence user identifier - a PUID that was not pursued.
On 2019-05-06 a related issue was posted on "Core - Section 8. Need more subject_type" to distinguish between ephemeral and persistent keys was raised (as an ID type) and not pursued.
Recently the DIF posted Self-Issued OpenID Connect Provider DID Profile which leaves the issue of sub alone and create a new field for the DID only.
On 2020-06-06 a proposal was posted to "Create a Separate Spec for Self-Issued Identifiers" that would address the issues about sub and a persistent ID in the context of the problem of key recovery, reissue and roll-over while giving the user a better experience with OpenID Connect.
On 2020-07-20 OpenID core agreed to create a document for review which is posted at: Self-Issued OpenID Connect Provider DID Profile

The current work of the Decentralized Identifiers has proceed with little attention for how it might interoperate with existing Identity Ecosystems.
The DIF SIOP spec creates a new fields for identifiers rather than fit within a common field that would promote interoperability with other methods.
Self-issued Identifiers of all types depend on secret values held by the user in portable protected storage, for example a smartphone or WebAuthn key.
If the user's hardware device is stolen or disabled, the recovery of the user's identifier can be a challenge which could turn into a UX nightmare if not handled well.
In particular the SIOP program has been developing standards which look a lot like the DIA and other work in the Kantara work groups without any coordination.
The current draft of the Kantara FIRE DIA spec treats the sub field as a random GUID to assure uniqueness.

The Subject ID (sub) could be freed from the limitations described the core spec above and take its traditional unstructured format. This would allow it to take on any form, like that of a DID or a GUID.
The Persistent User ID (puid) could be made mandatory in a new spec that included other information on the need for key recovery, reissue and roll-over. Those processes would be spelled out in some detail.
1. Any new identifier format (like the DID) should fit within the definition of this field as would new or propriety methods.
2. The id_token could be further described for optional Client Bound End-User Assertion (see reference below) in place of the traditional Bearer Token.
Specification of a token bound to the the creator and receiver. (e.g. Client Bound End user assertion.)

@@ Line 14: / Line 14: @@
 * Recently the DIF posted [https://identity.foundation/did-siop/ Self-Issued OpenID Connect Provider DID Profile] which leaves the issue of sub alone and create a new field for the DID only.
 * On 2020-06-06 a proposal was posted to "[https://bitbucket.org/openid/connect/issues/1175/create-a-separate-spec-for-self-issued Create a Separate Spec for Self-Issued Identifiers"] that would address the issues about sub and a persistent ID in the context of the problem of key recovery, reissue and roll-over while giving the user a better experience with OpenID Connect.
+* On 2020-07-20 OpenID core agreed to create a document for review which is posted at: [https://identity.foundation/did-siop/ Self-Issued OpenID Connect Provider DID Profile]
 ==Problems==