off topic - oidc sub claim value

[Tom Scavo]

On Tue, Jan 9, 2018 at 11:53 AM, Liam Hoekenga <liamr at umich.edu> wrote:
>
> We're in the process of piloting the Unicon MitreID Connect (OIDC) overlay
> for IDP 3.
>
> WRT the OIDC "sub" claim - is there an expectation that it's an opaque
> identifier?  There's a page in the shib wiki discussing name ids that
> suggests this -
> https://wiki.shibboleth.net/confluence/display/CONCEPT/NameIdentifiers

I wrote much of that page so let me weigh in. AFAIK, there is no
requirement that the OIDC 'sub' claim be opaque. In fact, the only two
requirements of the 'sub' claim are persistence (nowadays referred to
as "long-lived") and non-reassignment. That's the beauty of the 'sub'
claim---the actual requirements are minimal and therefore it can be
"all things to all people."

> Would an opaque, persistent identifier be considered best practice?

Well, you don't have to invent something new to satisfy the
requirements of the 'sub' claim. Is the ePPN you assert to SAML SPs
non-reassigned? If so, you can use that as the 'sub' claim. Do you
assert ePTID (or the equivalent SAML2 Persistent Identifier) to SAML
SPs? That will work as well.

I guess what I'm trying to say is: The identifier you assert for users
is a larger decision that should be orthogonal to the choice of SSO
protocol. The first big question is: are you going to bite the bullet
and support targeted identifiers despite the overhead? If privacy is
not a strict requirement, your job becomes a whole lot easier.

I hope that helps a little bit.

Tom