Difference between revisions of "Scope"
From MgmtWiki
(→Solution) |
(→Solution) |
||
| Line 21: | Line 21: | ||
Here will we describe the scopes available from [[OpenID Connect]] as a good example. | Here will we describe the scopes available from [[OpenID Connect]] as a good example. | ||
| − | + | The name of the scope is followed by two scores for the risk to the user: (1) user security applies for both loss of access loss of control, (2) user privacy applies to the impact if the data is made public, | |
{|border="1" padding="2" width="799px" | {|border="1" padding="2" width="799px" | ||
| − | | Name || | + | | Name || Sec Risk || Priv Risk|| Notes |
|- | |- | ||
| − | |openid ||Attribute ||driver's license || | + | |openid ||Attribute ||driver's license || requests access to the user_id (sub) [[Claim]] which is assumed to be pair-wise unique for the security score. |
|- | |- | ||
|profile || || || This requests that access to the End-User’s profile Claims excluding the address and email Claims at the UserInfo Endpoint be granted by the issued Access Token. | |profile || || || This requests that access to the End-User’s profile Claims excluding the address and email Claims at the UserInfo Endpoint be granted by the issued Access Token. | ||
Revision as of 21:42, 18 August 2018
Full Title or Meme
A request for Claims is a Scope.
Context
Claims typically go through a series of steps, for example:
- A User will go to a Web Site hosting a Resource that the user wants to access.
- The Web Site will send a collection of Scopes to a User asking for Claims to authorize access.
- The User Agent should know, a priori, where to send the Claims for verification.
- The verified claims will be collected and forwarded to the Web Site.
- The Web Site will evaluate the verified claims and determine whether to authorize access to the resource.
- Optionally the Web Site will request additional claims to meet the needs to authorize access.
- In computer networking a variety of statements can be made by a user to acquire authorized access to a resource.
- The distinction as to Authentication, who a user is, versus Authorization, or what that user is permitted to do, is no longer helpful.
- NIST has recognized that there are multiple metrics for the quality of statements about a user in their third update to SP 800-63
- Claims can be highly detailed, do to data fields, or a collection of fields, like the User address, this can be overwhelming if presented for User Consent. Some protocols, like OpenID Connect provide for aggregated collections of claims that OpenID calls Scope.[1]
Solution
Here will we describe the scopes available from OpenID Connect as a good example.
The name of the scope is followed by two scores for the risk to the user: (1) user security applies for both loss of access loss of control, (2) user privacy applies to the impact if the data is made public,
| Name | Sec Risk | Priv Risk | Notes |
| openid | Attribute | driver's license | requests access to the user_id (sub) Claim which is assumed to be pair-wise unique for the security score. |
| profile | This requests that access to the End-User’s profile Claims excluding the address and email Claims at the UserInfo Endpoint be granted by the issued Access Token. | ||
| UAF U2F | This requests that access to the email and verified Claims at the UserInfo Endpoint be granted by the issued Access Token. | ||
| Email validated | more significant for AuthN | ||
| address | UMA | This requests that access to address Claim at the UserInfo Endpoint be granted by the issued Access Token. | |
| phone | AuthZ | This requests that access to the phone_number Claim at the UserInfo Endpoint be granted by the issued Access Token | |
| phone validated | AuthN+AuthZ | OpenID Connect | more significant for AuthN |
References
- ↑ Nat Sakimura Scopes and Claims in OpenID Connect https://nat.sakimura.org/2012/01/26/scopes-and-claims-in-openid-connect/
