Claim Controls

[Takahiko Kawasaki]

Hi @Daniel Fett ,

Another approach for Selective Abort/Omit is to define how to control claims at a different place (e.g. in "claim_controls") and refer it indirectly (e.g. by "claim_controls_applied").

{
  "claim_controls": {
    "control_1": {
      "conditions": [
        // Describe conditions. Grammar needs defining.
      ],
      "actions": [
        // List actions such as "abort", ["omit", ...]
      ]
    }
  },
  "id_token": {
    "verified_claims": { },
    "claim_controls_applied": [
      "control_1"
    ]
  },
  "userinfo": {
    "verified_claims": { },
    "claim_controls_applied": [
      "control_1"
    ]
  },
  "transformed_claims": {
  }
}

Relevant Issues and PRs:

• Issue #1276: [SAO] Output claim set varies depending on evaluation order
• Issue #1301: convey error response in userinfo
• PR #56: Proposal for transferring match/unavailability metadata from the OP to the RP

‌

[Mark Haine]

Addressed by current ASD draft