Each signal shared between 2 partner should have unique identifier to establish chain-of-responsibility

[ashish1294]

When two partners share events, the receiver may act on the signal and take some action on the subject of the signal (user / session / device).

When acting without user's explicit credentials, it's important the receivers creates a log for users to look up on why the action was taken. It would be useful if there was a way for receiving partner's system to uniquely point to the event received from transmitting partner - such that user can further lookup the transmitting system's log to investigate why a particular event was sent.

Events / Signals may be chained as well :

Transmitter A -> Receiver B, Transmitter B -> Receiver C

It would nice for users to be able trace the event back the stack in-case an un-intended action is taken.

[tulshi]

Would the standard "jti" claim in JWTs work for this? Those are already present in SSF events.

[ashish1294]

jti may work - but the transmitters needs to persist those ids such that they can be looked up or linked to. Taking just-in-time hash of your payload and setting as it jti (which is often enough for uniqueness guarantee) won't work.

Also, one logical action / detection might light to multiple events sent to one or more receivers. E.g, "N" service providers may be each have a session federated by IDP. IDP detects some risk with the user - sends event for each active session of user to each service provider. Here, each event will have unique jti but from a chain-of-responsibility pov, they all were generated due to the same risk detection.

If would nice to get a link to that unique parent event for all these child event.

[appsdesh]

The spec defines TXN claim. Could you please check it out to see if that satisfies your requirement?

[ashish1294]

"txn" claim seems exactly what we were looking for. Thanks