Should OIDC subs be globally unique?

[Wessel, Keith]

Hi, all,

The examples for the public and pairwise subs shipped with the IdP are scoped, I presume to make them globally unique. I was looking at who's using the sub claim with our IdP to see if we were too late to switch it since our current value isn't scoped. One of our developers pointed out to me, though, that the spec states it just needs to be locally unique. [1]

Any guidance from this group on whether it's good to make it globally unique?

Thanks,
Keith

1. https://openid.net/specs/openid-connect-core-1_0.html#IDToken