Definition of the Entity Statement

[Kristina Yasuda]

It might be a little more helpful for the reader if the definition of the Entity Statement was a little more descriptive .

Entity statement

An entity statement is issued by an entity, which pertains to a subject entity and leaf entities. An entity statement is always a signed JWT.

Suggest something like below:

A JWT that contains XXX information. It is issued by an entity, which pertains to a subject entity and leaf entities.

‌

[Giuseppe De Marco]

In the Italian oidc fed 1.0 wg, we found the following difficulties in reading and interpreting the text:

1. mismatch between metadata and entity statement, the reader tends to confuse the two
2. creation of the trust chain. This is an essential aspect of the specification and to date is divided into two separate sections, 8.2 and 3.2. Perhaps it would be useful to "consolidate" a single section dedicated to the composition and validation of the chain, without requiring the reader to jump from one section to another to join the pieces.

I share with some notes here.
On point 1, on entity statement vs metadata we preferred this extreme disambiguation, as follows:

“““
In the OIDC Federation we use entity statements instead of metadata, an entity statement is a metadata described in a federative context.
”””

On point 2, we found that the following definition was very effective for our readers
”””
A trust anchor or intermediary may shape its policy on critical parts of the entity statements of its descentants, allowing them to be free to update their configuration without having to update it in a central register, except the public key, which cannot be changed without first being propagated to the trust anchor or intermediary
”””

[Michael Jones]

Mike to propose updated definition text.

[Michael Jones]

Will be fixed by https://bitbucket.org/openid/connect/pull-requests/159 .

[Michael Jones]

Fixed by https://bitbucket.org/openid/connect/pull-requests/159