[JIRA] (JOIDC-100) Releasing IAT, EXP and NBF claims from the UserInfo endpoint

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on JOIDC-100 ( https://shibboleth.atlassian.net/browse/JOIDC-100?atlOrigin=eyJpIjoiNjIxNTMxYmJmZmZjNGM4OWE4ODEwY2QxOGQ2NThmNGIiLCJwIjoiaiJ9 )

Re: Releasing IAT, EXP and NBF claims from the UserInfo endpoint ( https://shibboleth.atlassian.net/browse/JOIDC-100?atlOrigin=eyJpIjoiNjIxNTMxYmJmZmZjNGM4OWE4ODEwY2QxOGQ2NThmNGIiLCJwIjoiaiJ9 )

We can’t allow built-in claims like that, they’re controlled vocabulary.

We can, if it’s allowed by the spec, just add them to the JWT it returns of course, but I’m leery of promising things like “nbf must be equal to iat” because that is definitely not a requirement of any spec. I think we probably would do that just in terms of what the likely value would be, but it’s hard to promise it absolutely.

It’s not at all clear what the exp claim would be either, the UserInfo response isn’t really a security token with these kinds of semantics. It’s just data. This is like using a SAML query but expecting the response to be a usable SAML assertion for some other flow. It’s not, it’s just data.

( https://shibboleth.atlassian.net/browse/JOIDC-100#add-comment?atlOrigin=eyJpIjoiNjIxNTMxYmJmZmZjNGM4OWE4ODEwY2QxOGQ2NThmNGIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JOIDC-100#add-comment?atlOrigin=eyJpIjoiNjIxNTMxYmJmZmZjNGM4OWE4ODEwY2QxOGQ2NThmNGIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/112b69d8/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-6aa077ec-009c-48ca-9da4-acce8d6bbc75
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/112b69d8/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-f64b2bc5-21de-47ae-8f32-730bf3d0b8a9
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/112b69d8/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-3afdb2ec-a52f-44a3-9da3-f0926ccda955
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/112b69d8/attachment-0005.png>