Proposal for "information_uri"

[surfnet-niels]

I would like to propose to add a way to provide addition information about the event via a URI. Two real world usecases for this:

• Publishing metadata registration policy for a registration event
  In R&E SAML federations this is a common way to signal what the policy context of the registration entails, see e.g.: [Metadata Registration Practice Statement for SURFconext](https://servicedesk.surf.nl/wiki/spaces/IAM/pages/128910076/Metadata+Registration+Practice+Statement+for+SURFconext) or InCommon Metadata Registration Practice Statement)
• Providing addition information in case of security incidents, like e.g. a link to the relevant CVE

I added proposal for "information_uri": an (OPTIONAL) URI that may offer additional information about the event, to the "Event Object Parameters" section and also added two examples based on the use cases above in the example

[peppelinux]

we should say that it SHOULD be an https url, do we agree?

[surfnet-niels]

Yes

[selfissued]

How is the URI intended to be used? I can imagine all of these possibilities:

• The URI is an identifier, like trust_mark_type is in OpenID Federation
• The URI is a URL to a human-readable document, like information_uri is in OpenID Federation
• The URI is a URL to an image intended for humans, like logo_uri is in OpenID Federation
• The URI is a URL to a JSON data structure, like jwks_uri is in OpenID Connect

Which ones of these (and ones I may not have thought of) are the intended usage of information_uri? The spec should say.

[surfnet-niels]

@selfissued I intended it as a human readable document, hence also why I used information_uri, as that has the same function in the core spec