Skip to content

Commit 9cceb64

Browse files
tulshitulshi
committed
Fixes #60 - are subjecst required
1 parent ae0cf79 commit 9cceb64

File tree

3 files changed

+284
-116
lines changed

3 files changed

+284
-116
lines changed

‎openid-sharedsignals-framework-1_0.html‎

Lines changed: 83 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3701,14 +3701,29 @@ <h5 id="name-verification-event">
37013701
triggered. This is a nested attribute in the event payload.<a href="#section-7.1.4.1-5.1.1" class="pilcrow"></a></p>
37023702
</li>
37033703
</ul>
3704-
<p id="section-7.1.4.1-6">Upon receiving a Verification Event, the Event Receiver SHALL parse the SET and
3704+
<p id="section-7.1.4.1-6">subject<a href="#section-7.1.4.1-6" class="pilcrow"></a></p>
3705+
<ul class="normal ulEmpty">
3706+
<li class="normal ulEmpty" id="section-7.1.4.1-7.1">
3707+
<p id="section-7.1.4.1-7.1.1">REQUIRED. The value of the <code>subject</code> field in a Verification Event MUST always
3708+
be set to have a simple value of type <code>opaque</code>. The <code>id</code> of the value MUST be
3709+
the <code>stream_id</code> of the stream being verified. If the Transmitter does not
3710+
support multiple streams, this value MUST be set to "0"<a href="#section-7.1.4.1-7.1.1" class="pilcrow"></a></p>
3711+
</li>
3712+
</ul>
3713+
<ul class="normal ulEmpty">
3714+
<li class="normal ulEmpty" id="section-7.1.4.1-8.1">
3715+
<p id="section-7.1.4.1-8.1.1">Note that the subject that identifies a stream itself is always implicitly
3716+
added to the stream and MAY NOT be removed from the stream.<a href="#section-7.1.4.1-8.1.1" class="pilcrow"></a></p>
3717+
</li>
3718+
</ul>
3719+
<p id="section-7.1.4.1-9">Upon receiving a Verification Event, the Event Receiver SHALL parse the SET and
37053720
validate its claims. In particular, the Event Receiver SHALL confirm that the
37063721
value for "state" is as expected. If the value of "state" does not match, an
37073722
error response of "setData" SHOULD be returned (see Section 2.3 of
3708-
<span>[<a href="#DELIVERYPUSH" class="cite xref">DELIVERYPUSH</a>]</span> or <span>[<a href="#DELIVERYPOLL" class="cite xref">DELIVERYPOLL</a>]</span>).<a href="#section-7.1.4.1-6" class="pilcrow"></a></p>
3709-
<p id="section-7.1.4.1-7">In many cases, Event Transmitters MAY disable or suspend an Event Stream that
3723+
<span>[<a href="#DELIVERYPUSH" class="cite xref">DELIVERYPUSH</a>]</span> or <span>[<a href="#DELIVERYPOLL" class="cite xref">DELIVERYPOLL</a>]</span>).<a href="#section-7.1.4.1-9" class="pilcrow"></a></p>
3724+
<p id="section-7.1.4.1-10">In many cases, Event Transmitters MAY disable or suspend an Event Stream that
37103725
fails to successfully verify based on the acknowledgement or lack of
3711-
acknowledgement by the Event Receiver.<a href="#section-7.1.4.1-7" class="pilcrow"></a></p>
3726+
acknowledgement by the Event Receiver.<a href="#section-7.1.4.1-10" class="pilcrow"></a></p>
37123727
</section>
37133728
</div>
37143729
<div id="triggering-a-verification-event">
@@ -3825,6 +3840,10 @@ <h5 id="name-triggering-a-verification-e">
38253840
"iat": 1493856000,
38263841
"events": {
38273842
"https://schemas.openid.net/secevent/ssf/event-type/verification":{
3843+
"subject": {
3844+
"format": "opaque",
3845+
"id": "1234"
3846+
},
38283847
"state": "VGhpcyBpcyBhbiBleGFtcGxlIHN0YXRlIHZhbHVlLgo="
38293848
}
38303849
}
@@ -3873,14 +3892,29 @@ <h4 id="name-stream-updated-event">
38733892
<p id="section-7.1.5-9">subject<a href="#section-7.1.5-9" class="pilcrow"></a></p>
38743893
<ul class="normal ulEmpty">
38753894
<li class="normal ulEmpty" id="section-7.1.5-10.1">
3876-
<p id="section-7.1.5-10.1.1">OPTIONAL. Specifies the Subject Principal for whom the status has been updated.
3895+
<p id="section-7.1.5-10.1.1">REQUIRED. Specifies the Subject Principal for whom the status has been updated.
38773896
If this claim is not included, then the status change was applied to all
3878-
subjects in the stream.<a href="#section-7.1.5-10.1.1" class="pilcrow"></a></p>
3897+
subjects in the stream. If the event applies to the entire stream, the value
3898+
of the <code>subject</code> field MUST be of format <code>opaque</code>, and its <code>id</code> value MUST be
3899+
the unique ID of the stream. If the Transmitter does not support multiple
3900+
streams, then the value of the <code>id</code> field MUST be the string "0".<a href="#section-7.1.5-10.1.1" class="pilcrow"></a></p>
3901+
</li>
3902+
</ul>
3903+
<ul class="normal ulEmpty">
3904+
<li class="normal ulEmpty" id="section-7.1.5-11.1">
3905+
<p id="section-7.1.5-11.1.1">Note that the subject that identifies a stream itself is always implicitly
3906+
added to the stream and MAY NOT be removed from the stream.<a href="#section-7.1.5-11.1.1" class="pilcrow"></a></p>
3907+
</li>
3908+
</ul>
3909+
<ul class="normal ulEmpty">
3910+
<li class="normal ulEmpty" id="section-7.1.5-12.1">
3911+
<p id="section-7.1.5-12.1.1">Below is a non-normative example of a <code>stream-updated</code> event with a specific
3912+
subject.<a href="#section-7.1.5-12.1.1" class="pilcrow"></a></p>
38793913
</li>
38803914
</ul>
3881-
<span id="name-example-stream-updated-set"></span><div id="figstreamupdatedset">
3915+
<span id="name-example-stream-updated-set-"></span><div id="figstreamupdatedset">
38823916
<figure id="figure-41">
3883-
<div class="lang-json sourcecode" id="section-7.1.5-11.1">
3917+
<div class="lang-json sourcecode" id="section-7.1.5-13.1">
38843918
<pre>
38853919
{
38863920
"jti": "123456",
@@ -3904,7 +3938,39 @@ <h4 id="name-stream-updated-event">
39043938
</pre>
39053939
</div>
39063940
<figcaption><a href="#figure-41" class="selfRef">Figure 41</a>:
3907-
<a href="#name-example-stream-updated-set" class="selfRef">Example: Stream Updated SET</a>
3941+
<a href="#name-example-stream-updated-set-" class="selfRef">Example: Stream Updated SET with tenant principal</a>
3942+
</figcaption></figure>
3943+
</div>
3944+
<ul class="normal ulEmpty">
3945+
<li class="normal ulEmpty" id="section-7.1.5-14.1">
3946+
<p id="section-7.1.5-14.1.1">Below is a non-normative example of a <code>stream-updated</code> event with a stream
3947+
subject.<a href="#section-7.1.5-14.1.1" class="pilcrow"></a></p>
3948+
</li>
3949+
</ul>
3950+
<span id="name-example-stream-updated-set-w"></span><div id="figstreamupdatedstreamset">
3951+
<figure id="figure-42">
3952+
<div class="lang-json sourcecode" id="section-7.1.5-15.1">
3953+
<pre>
3954+
{
3955+
"jti": "123456",
3956+
"iss": "https://transmitter.example.com",
3957+
"aud": "receiver.example.com",
3958+
"iat": 1493856000,
3959+
"events": {
3960+
"https://schemas.openid.net/secevent/ssf/event-type/stream-updated": {
3961+
"subject": {
3962+
"format": "opaque",
3963+
"id" : "0"
3964+
},
3965+
"status": "paused",
3966+
"reason": "Internal error"
3967+
}
3968+
}
3969+
}
3970+
</pre>
3971+
</div>
3972+
<figcaption><a href="#figure-42" class="selfRef">Figure 42</a>:
3973+
<a href="#name-example-stream-updated-set-w" class="selfRef">Example: Stream Updated SET with stream as the subject of single-stream Transmitter</a>
39083974
</figcaption></figure>
39093975
</div>
39103976
</section>
@@ -4107,7 +4173,7 @@ <h4 id="name-ssf-event-properties">
41074173
<p id="section-11.1.3-1">The SSF event MAY contain additional claims within the event payload that are
41084174
specific to the event type.<a href="#section-11.1.3-1" class="pilcrow"></a></p>
41094175
<span id="name-example-set-containing-a-ri"></span><div id="risc-event-subject-example">
4110-
<figure id="figure-42">
4176+
<figure id="figure-43">
41114177
<div class="lang-json sourcecode" id="section-11.1.3-2.1">
41124178
<pre>
41134179
{
@@ -4128,12 +4194,12 @@ <h4 id="name-ssf-event-properties">
41284194
}
41294195
</pre>
41304196
</div>
4131-
<figcaption><a href="#figure-42" class="selfRef">Figure 42</a>:
4197+
<figcaption><a href="#figure-43" class="selfRef">Figure 43</a>:
41324198
<a href="#name-example-set-containing-a-ri" class="selfRef">Example: SET Containing a RISC Event with a Phone Number Subject</a>
41334199
</figcaption></figure>
41344200
</div>
41354201
<span id="name-example-set-containing-a-ca"></span><div id="caep-event-properties-example">
4136-
<figure id="figure-43">
4202+
<figure id="figure-44">
41374203
<div class="lang-json sourcecode" id="section-11.1.3-3.1">
41384204
<pre>
41394205
{
@@ -4153,7 +4219,7 @@ <h4 id="name-ssf-event-properties">
41534219
}
41544220
</pre>
41554221
</div>
4156-
<figcaption><a href="#figure-43" class="selfRef">Figure 43</a>:
4222+
<figcaption><a href="#figure-44" class="selfRef">Figure 44</a>:
41574223
<a href="#name-example-set-containing-a-ca" class="selfRef">Example: SET Containing a CAEP Event with Properties</a>
41584224
</figcaption></figure>
41594225
</div>
@@ -4166,7 +4232,7 @@ <h4 id="name-explicit-typing-of-sets">
41664232
</h4>
41674233
<p id="section-11.1.4-1">SSF events MUST use explicit typing as defined in Section 2.3 of <span>[<a href="#RFC8417" class="cite xref">RFC8417</a>]</span>.<a href="#section-11.1.4-1" class="pilcrow"></a></p>
41684234
<span id="name-explicitly-typed-jose-heade"></span><div id="explicit-type-header">
4169-
<figure id="figure-44">
4235+
<figure id="figure-45">
41704236
<div class="lang-json sourcecode" id="section-11.1.4-2.1">
41714237
<pre>
41724238
{
@@ -4175,7 +4241,7 @@ <h4 id="name-explicit-typing-of-sets">
41754241
}
41764242
</pre>
41774243
</div>
4178-
<figcaption><a href="#figure-44" class="selfRef">Figure 44</a>:
4244+
<figcaption><a href="#figure-45" class="selfRef">Figure 45</a>:
41794245
<a href="#name-explicitly-typed-jose-heade" class="selfRef">Explicitly Typed JOSE Header</a>
41804246
</figcaption></figure>
41814247
</div>
@@ -4214,7 +4280,7 @@ <h4 id="name-the-aud-claim">
42144280
this service might reroute SETs to respective Receivers, an "aud" claim with
42154281
multiple Receivers would lead to unintended data disclosure.<a href="#section-11.1.6-3" class="pilcrow"></a></p>
42164282
<span id="name-example-set-with-array-aud-"></span><div id="figarrayaud">
4217-
<figure id="figure-45">
4283+
<figure id="figure-46">
42184284
<div class="lang-json sourcecode" id="section-11.1.6-4.1">
42194285
<pre>
42204286
{
@@ -4230,7 +4296,7 @@ <h4 id="name-the-aud-claim">
42304296
}
42314297
</pre>
42324298
</div>
4233-
<figcaption><a href="#figure-45" class="selfRef">Figure 45</a>:
4299+
<figcaption><a href="#figure-46" class="selfRef">Figure 46</a>:
42344300
<a href="#name-example-set-with-array-aud-" class="selfRef">Example: SET with array 'aud' claim</a>
42354301
</figcaption></figure>
42364302
</div>

‎openid-sharedsignals-framework-1_0.md‎

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,6 +1718,16 @@ state
17181718
> OPTIONAL An opaque value provided by the Event Receiver when the event is
17191719
triggered. This is a nested attribute in the event payload.
17201720

1721+
subject
1722+
1723+
> REQUIRED. The value of the `subject` field in a Verification Event MUST always
1724+
be set to have a simple value of type `opaque`. The `id` of the value MUST be
1725+
the `stream_id` of the stream being verified. If the Transmitter does not
1726+
support multiple streams, this value MUST be set to "0"
1727+
1728+
> Note that the subject that identifies a stream itself is always implicitly
1729+
added to the stream and MAY NOT be removed from the stream.
1730+
17211731
Upon receiving a Verification Event, the Event Receiver SHALL parse the SET and
17221732
validate its claims. In particular, the Event Receiver SHALL confirm that the
17231733
value for "state" is as expected. If the value of "state" does not match, an
@@ -1802,6 +1812,10 @@ Event Receiver as a result of the above request:
18021812
"iat": 1493856000,
18031813
"events": {
18041814
"https://schemas.openid.net/secevent/ssf/event-type/verification":{
1815+
"subject": {
1816+
"format": "opaque",
1817+
"id": "1234"
1818+
},
18051819
"state": "VGhpcyBpcyBhbiBleGFtcGxlIHN0YXRlIHZhbHVlLgo="
18061820
}
18071821
}
@@ -1838,9 +1852,18 @@ reason
18381852

18391853
subject
18401854

1841-
> OPTIONAL. Specifies the Subject Principal for whom the status has been updated.
1855+
> REQUIRED. Specifies the Subject Principal for whom the status has been updated.
18421856
If this claim is not included, then the status change was applied to all
1843-
subjects in the stream.
1857+
subjects in the stream. If the event applies to the entire stream, the value
1858+
of the `subject` field MUST be of format `opaque`, and its `id` value MUST be
1859+
the unique ID of the stream. If the Transmitter does not support multiple
1860+
streams, then the value of the `id` field MUST be the string "0".
1861+
1862+
> Note that the subject that identifies a stream itself is always implicitly
1863+
added to the stream and MAY NOT be removed from the stream.
1864+
1865+
> Below is a non-normative example of a `stream-updated` event with a specific
1866+
subject.
18441867

18451868
~~~ json
18461869
{
@@ -1863,7 +1886,30 @@ subject
18631886
}
18641887
}
18651888
~~~
1866-
{: title="Example: Stream Updated SET" #figstreamupdatedset}
1889+
{: title="Example: Stream Updated SET with tenant principal" #figstreamupdatedset}
1890+
1891+
> Below is a non-normative example of a `stream-updated` event with a stream
1892+
subject.
1893+
1894+
~~~ json
1895+
{
1896+
"jti": "123456",
1897+
"iss": "https://transmitter.example.com",
1898+
"aud": "receiver.example.com",
1899+
"iat": 1493856000,
1900+
"events": {
1901+
"https://schemas.openid.net/secevent/ssf/event-type/stream-updated": {
1902+
"subject": {
1903+
"format": "opaque",
1904+
"id" : "0"
1905+
},
1906+
"status": "paused",
1907+
"reason": "Internal error"
1908+
}
1909+
}
1910+
}
1911+
~~~
1912+
{: title="Example: Stream Updated SET with stream as the subject of single-stream Transmitter" #figstreamupdatedstreamset}
18671913

18681914
# Authorization {#management-api-auth}
18691915
HTTP API calls from a Receiver to a Transmitter SHOULD be authorized by

0 commit comments

Comments
 (0)