Trust Mark Introspection

[Roland Hedberg]

I think it’s reasonable to assume that some of not all Trust Marks will stop being active for some reason. They might for instance have an expiration time or they might be revoked.

Regarding the former that is covered by having the expiration time in the trust mark as is now defined here.

When it comes to it being revoked we don’t have a convenient way of doing it right now.

That is why I proposed that we add an operation called trust_mark to the ones we already have.

There are 4 items of informationen that together uniquely defines a trust mark

• iss
• sub
• id
• iat

If we assume that the host hosting the endpoint is the same as the trust mark issuer then iss is implicit. The rest would be mandatory. An example of a request would then be:

GET /status_endpoint?
sub=https%3A%2F%2Fopenid.sunet.se%2FRP
&id=https%3A%2F%2Frefeds.org%2Fsirtfi
&iat=1640776883
HTTP/1.1
Host: operations.swamid.se

And a response:

200 OK
Last-Modified: Wed, 29 Dec 2021 12:23:56 GMT
Content-Type: application/json

{
  "active"=true
}

Having the respons be JSON allows for easy addition of extra information.

‌

[David W Chadwick]

This is very similar to the TRAIN trust scheme used in VCs, in which the verifier asks if an entity (iss in your scheme, VC issuer in TRAIN) is a member of a trust scheme (id in your scheme). The differences are as follows:

• trust scheme is identified by a DNS name instead of a URL
• there is no iat in the request as the verifier wants to know the result for “now”
• the result returns additional parameters, the main one being, in the VC case, a pointer to the issuer’s published schema for the VCs that it issues.

‌

[Giuseppe De Marco]

@roland can we consider to have the iat parameter as optional?

[Roland Hedberg]

If the issuer periodically refreshes the trust mark then you need iat to distinguish between the different instances.

Taking up on what @david writes I can imaging specifying that if iat is undefined and there are more the one trust mark with the same iss, sub and id combination then the query is about the latest emitted one.

[Giuseppe De Marco]

I’d consider to have only a response that tells that the trust mark is active right now, in the present.

I was wondering if there could be also a way, via HTTP POST, to submit the trust mark as it is (signed JWT) and get the same result from the endpoint like it were been requested using the urlencoded paramenters

[Roland Hedberg]

Yes, to submitting the trust mark instead of the parameters. That was part of my initial idea.

[Roland Hedberg]

I’ve constructed a Pull Request that describes the proposal: https://bitbucket.org/openid/connect/pull-requests/104/added-new-federation-api-operation-trust

[Michael Jones]

As discussed during the 10-Jan-22 call, it's probably reasonable to add this operation. The exact syntax probably depends upon the outcome of issue #1387.

[Roland Hedberg]

Resulted in PR #104 which has been merged.