Messages, Standard security considerations use of "the assertion" language

[Michael Jones]

The Security Considerations sections contain a lot of language like "To mitigate this threat, the assertion...". The "assertion" language should be made more specific by using the terms ID Token, Access Token, or both.

[Nat Sakimura]

Actually, it could be also UserInfo response.

Assertion in SP800-63 is pretty much the "(IdP asserted) set of claims". We had this definition before, but was removed from the subsequent drafts because it is only used in Security Consideration to map to SP800-63.

In Basic, we have this sentence at the beginning of the security consideration.

An assertion is the result of the authentication performed by the Authorization Server that was provided to the Client. The assertion is used to pass information about the End-User or the authentication process from the Authorization Server to the Client.

BTW, the link of SP800-63 got changed, so we need to fix it: New location: http://csrc.nist.gov/publications/drafts/800-63-rev1/SP800-63-Rev1-Draft3_June2011.pdf

It is still a draft and the URL is not stable. Perhaps we should incorporate them in this spec.

I will take a crack at the text.

[Nat Sakimura]

Message is done with Wiki macro error: Changeset 98b64ebdac66 not found.

[Nat Sakimura]

Re #298 Message - Removed remaining user of assertion.

→ eaa079f4bc15