Editorial: Section 5.2.2.2.1. Duplicate Clause?

[Ralph Bragg]

Are both statements required in this sentence. I’ve read both of them backwards and forwards trying to see how they could be interpreted differently.

1. if returning any sensitive personally identifiable information (PII) in the ID Token in the authorization response, should sign and encrypt the ID Token;
2. if not encrypting the ID Token, should not return sensitive personally identifiable information (PII) in the ID Token in the authorization response

‌

[Joseph Heenan]

I think because they’re “should” rather than must they have slightly different meanings, but the points they’re making definitely overlap. The second one more strongly says “if you’re not going to follow the recommendation to encrypt, you should at least reduce the number of claims returned from the Authorization Endpoint”.

‌

[Brian Campbell]

I’d suggest making it only about encryption. i.e., “if PII in ID Token in authz response, should/shall encrypt”. A statement like “if returning any sensitive personally identifiable information (PII) in the ID Token in the authorization response, should sign and encrypt the ID Token” could be read as not needing the signature if there’s no PII. But the signature is needed for other reasons. And required by other parts of FAPI and OIDC.

‌

[Nat Sakimura]

Brian’s proposal seems sensible. Thoughts?

[Ralph Bragg]

if PII in ID Token in authz response, shall encrypt gets my vote

if returning any sensitive personally identifiable information (PII) in the ID Token in the authorization response, shall encrypt the ID Token

I don’t think restating the semantics / requirements of an id_token is necessary.

[Nat Sakimura]

fixes #322 - Editorial: Section 5.2.2.2.1. Duplicate Clause

→ <<cset 04fba975ad57>>

[Nat Sakimura]

fixes #322 - Editorial: Section 5.2.2.2.1. Duplicate Clause

→ <<cset 2dc23de3dc0d>>

[Nat Sakimura]

Merged in issue_322 (pull request #200)

fixes #322 - Editorial: Section 5.2.2.2.1. Duplicate Clause

Approved-by: Nat Sakimura

→ <<cset 09b551557e0a>>