Should OIDC subs be globally unique?

[Cantor, Scott]

On 3/24/22, 7:12 PM, "users on behalf of Wessel, Keith via users" <users-bounces at shibboleth.net on behalf of users at shibboleth.net> wrote:

>    The examples for the public and pairwise subs shipped with the IdP are scoped, I presume to make them
> globally unique. I was looking at who's using the sub claim with our IdP to see if we were too late to switch it
> since our current value isn't scoped. One of our developers pointed out to me, though, that the spec states it
> just needs to be locally unique. [1]

Yes, and that will us all a lot when an app inevitable does the same thing MS did and doesn't scope it themselves. I also had to listen to a decade of complaints that value@<long ugly URI or string> was not a friendly identifier format (Targeted ID, remember? Same thing.). I listened and I took it to heart.

I believe the same spec that allows them to be locally unique also allows them to be fully whitespace.

People can do whatever they prefer but I'm comfortable with the example we provided as being a good practice that costs nothing (aside from migration obviously, that's why these decisions matter so much).

-- Scott