You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Link terminology to definitions
* Update lws10-authn-openid/index.html
Co-authored-by: Pierre-Antoine Champin <pierre-antoine@w3.org>
* Add local proxy definitions to authentication documents and simplified term references
* Use LWS10-CORE as a localBiblio name, as suggested
* link terminology from access requests section
---------
Co-authored-by: Pierre-Antoine Champin <pierre-antoine@w3.org>
Copy file name to clipboardExpand all lines: lws10-authn-openid/index.html
+15-15Lines changed: 15 additions & 15 deletions
Original file line number
Diff line number
Diff line change
@@ -26,9 +26,9 @@
26
26
xref: ["web-platform"],
27
27
group: "lws",
28
28
localBiblio: {
29
-
"LWS-PROTOCOL": {
30
-
title: "LWS Protocol",
31
-
href: "https://www.w3.org/TR/lws-core/",
29
+
"LWS10-CORE": {
30
+
title: "Linked Web Storage Protocol 1.0",
31
+
href: "https://www.w3.org/TR/lws10-core/",
32
32
publisher: "W3C",
33
33
status: "FPWD",
34
34
},
@@ -84,7 +84,7 @@ <h2>Terminology</h2>
84
84
</p>
85
85
86
86
<p>
87
-
The terms "authentication credential" and "authentication suite" are defined by Linked Web Storage Protocol [[!LWS-PROTOCOL]]
87
+
The terms "<dfndata-cite="LWS10-CORE#dfn-agent">agent</dfn>", "<dfndata-cite="LWS10-CORE#dfn-authentication-credential">authentication credential</dfn>", and "<dfndata-cite="LWS10-CORE#dfn-authentication-suite">authentication suite</dfn>" are defined by Linked Web Storage Protocol [[!LWS10-CORE]]
For an ID Token to validate as an LWS authentication credential,
154
+
For an ID Token to validate as an LWS <a>authentication credential</a>,
155
155
there must be a trust relationship between the verifier and the issuing party.
156
156
</p>
157
157
158
158
<p>
159
-
In the absence of a pre-existing trust relationship, the validator MUST dereference the <code>sub</code> (subject) claim in the authentication credential.
159
+
In the absence of a pre-existing trust relationship, the validator MUST dereference the <code>sub</code> (subject) claim in the <a>authentication credential</a>.
160
160
The resulting resource MUST be formatted as a valid controlled identifier document [[!CID-1.0]] with an <code>id</code> value equal to the subject identifier.
161
161
</p>
162
162
163
163
<p>
164
164
The verifier MUST use the subject's controlled identifier document to locate a service object whose <code>serviceEndpoint</code> value
165
-
is equal to the value of the <code>iss</code> claim from the authentication credential, and whose <code>type</code> value is equal to <code>https://www.w3.org/ns/lws#OpenIdProvider</code>.
166
-
The verifier MUST perform OpenID Connect Discovery to locate the public portion of the JSON Web Key (JWK) used to sign the authentication credential.
165
+
is equal to the value of the <code>iss</code> claim from the <a>authentication credential</a>, and whose <code>type</code> value is equal to <code>https://www.w3.org/ns/lws#OpenIdProvider</code>.
166
+
The verifier MUST perform OpenID Connect Discovery to locate the public portion of the JSON Web Key (JWK) used to sign the <a>authentication credential</a>.
167
167
The JWT MUST be validated as described by OpenID Connect Core Section 3.1.3.7 [[!OPENID-CONNECT-CORE]].
168
168
</p>
169
169
170
170
<p>
171
-
An example Controlled Identifier Document for an agent using OpenID Connect is included below.
171
+
An example Controlled Identifier Document for an <a>agent</a> using OpenID Connect is included below.
An ID Token used as an authentication credential MUST use the <code>urn:ietf:params:oauth:token-type:id_token</code> URI when interacting with an authorization server.
192
+
An ID Token used as an <a>authentication credential</a> MUST use the <code>urn:ietf:params:oauth:token-type:id_token</code> URI when interacting with an authorization server.
An OpenID provider should support a mechanism to restrict the audience of an authentication credential to a limited set of entities, including an authorization server.
205
+
An OpenID provider should support a mechanism to restrict the audience of an <a>authentication credential</a> to a limited set of entities, including an authorization server.
206
206
One mechanism for achieving this is to use Resource Indicators for OAuth 2.0 [[RFC8707]].
207
-
A client in possession of an authentication credential with no audience restrictions should exchange this token for an equivalent audience-restricted token by using, for example, OAuth 2.0 Token Exchange [[RFC8693]].
207
+
A client in possession of an <a>authentication credential</a> with no audience restrictions should exchange this token for an equivalent audience-restricted token by using, for example, OAuth 2.0 Token Exchange [[RFC8693]].
Copy file name to clipboardExpand all lines: lws10-authn-saml/index.html
+9-9Lines changed: 9 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -26,9 +26,9 @@
26
26
xref: ["web-platform"],
27
27
group: "lws",
28
28
localBiblio: {
29
-
"LWS-PROTOCOL": {
30
-
title: "LWS Protocol",
31
-
href: "https://www.w3.org/TR/lws-core/",
29
+
"LWS10-CORE": {
30
+
title: "Linked Web Storage Protocol 1.0",
31
+
href: "https://www.w3.org/TR/lws10-core/",
32
32
publisher: "W3C",
33
33
status: "FPWD",
34
34
},
@@ -70,15 +70,15 @@ <h2>Terminology</h2>
70
70
</p>
71
71
72
72
<p>
73
-
The terms "authentication credential" and "authentication suite" are defined by Linked Web Storage Protocol [[!LWS-PROTOCOL]]
73
+
The terms "<dfndata-cite="LWS10-CORE#dfn-authentication-credential">authentication credential</dfn>" and "<dfndata-cite="LWS10-CORE#dfn-authentication-suite">authentication suite</dfn>" are defined by Linked Web Storage Protocol [[!LWS10-CORE]]
74
74
</p>
75
75
</section>
76
76
77
77
<sectionid="serialization">
78
78
<h2>Authentication Credential Serialization</h2>
79
79
80
80
<p>
81
-
SAML tokens used as authentication credentials MUST be signed. In addition, a valid SAML token MUST include the following assertions:
81
+
SAML tokens used as <a>authentication credentials</a> MUST be signed. In addition, a valid SAML token MUST include the following assertions:
A SAML 2.0 assertion used as an authentication credential MUST use the <code>urn:ietf:params:oauth:token-type:saml2</code> URI when interacting with an authorization server.
165
+
A SAML 2.0 assertion used as an <a>authentication credential</a> MUST use the <code>urn:ietf:params:oauth:token-type:saml2</code> URI when interacting with an authorization server.
Copy file name to clipboardExpand all lines: lws10-authn-ssi-cid/index.html
+12-12Lines changed: 12 additions & 12 deletions
Original file line number
Diff line number
Diff line change
@@ -26,9 +26,9 @@
26
26
xref: ["web-platform"],
27
27
group: "lws",
28
28
localBiblio: {
29
-
"LWS-PROTOCOL": {
30
-
title: "LWS Protocol",
31
-
href: "https://www.w3.org/TR/lws-core/",
29
+
"LWS10-CORE": {
30
+
title: "Linked Web Storage Protocol 1.0",
31
+
href: "https://www.w3.org/TR/lws10-core/",
32
32
publisher: "W3C",
33
33
status: "FPWD",
34
34
},
@@ -52,8 +52,8 @@
52
52
<h2>Introduction</h2>
53
53
<p>
54
54
Self-issued identity is important for cases where applications act on their own behalf. This includes autonomous bots as well as server-side scripts, among others.
55
-
In these cases, the agent is able to securely manage the private portion of a keypair, which it uses to generate signed JSON Web Tokens (JWT).
56
-
This specification describes how this class of agents can generate authentication credentials that can be used with a Linked Web Storage.
55
+
In these cases, the <a>agent</a> is able to securely manage the private portion of a keypair, which it uses to generate signed JSON Web Tokens (JWT).
56
+
This specification describes how this class of <a>agents</a> can generate <a>authentication credentials</a> that can be used with a Linked Web Storage.
57
57
</p>
58
58
</section>
59
59
<sectionid="conformance"></section>
@@ -74,15 +74,15 @@ <h2>Terminology</h2>
74
74
</p>
75
75
76
76
<p>
77
-
The terms "authentication credential" and "authentication suite" are defined by Linked Web Storage Protocol [[!LWS-PROTOCOL]]
77
+
The terms "<dfndata-cite="LWS10-CORE#dfn-agent">agent</dfn>", "<dfndata-cite="LWS10-CORE#dfn-authentication-credential">authentication credential</dfn>", and "<dfndata-cite="LWS10-CORE#dfn-authentication-suite">authentication suite</dfn>" are defined by Linked Web Storage Protocol [[!LWS10-CORE]]
78
78
</p>
79
79
</section>
80
80
81
81
<sectionid="serialization">
82
82
<h2>Authentication Credential Serialization</h2>
83
83
84
84
<p>
85
-
A self-issued authentication credential is serialized as a signed JSON Web Token (JWT). In order to use a JWT as an LWS authentication credential, the following additional requirements apply.
85
+
A self-issued <a>authentication credential</a> is serialized as a signed JSON Web Token (JWT). In order to use a JWT as an LWS <a>authentication credential</a>, the following additional requirements apply.
In order to validate a JWT as an LWS authentication credential, there must be a trust relationship between the verifier and the issuing party.
150
+
In order to validate a JWT as an LWS <a>authentication credential</a>, there must be a trust relationship between the verifier and the issuing party.
151
151
</p>
152
152
153
153
<p>
154
-
In the absence of a pre-existing trust relationship, the verifier MUST dereference the <code>sub</code> (subject) claim in the authentication credential.
154
+
In the absence of a pre-existing trust relationship, the verifier MUST dereference the <code>sub</code> (subject) claim in the <a>authentication credential</a>.
155
155
The resulting resource MUST be formatted as a valid controlled identifier document [[!CID-1.0]] with an <code>id</code> value equal to the subject identifier.
A self-issued JSON Web Token used as an authentication credential MUST use the <code>urn:ietf:params:oauth:token-type:jwt</code> URI when interacting with an authorization server.
206
+
A self-issued JSON Web Token used as an <a>authentication credential</a> MUST use the <code>urn:ietf:params:oauth:token-type:jwt</code> URI when interacting with an authorization server.
Copy file name to clipboardExpand all lines: lws10-authn-ssi-did-key/index.html
+10-10Lines changed: 10 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -31,9 +31,9 @@
31
31
href: "https://w3c-ccg.github.io/did-key-spec/",
32
32
publisher: "W3C",
33
33
},
34
-
"LWS-PROTOCOL": {
35
-
title: "LWS Protocol",
36
-
href: "https://www.w3.org/TR/lws-core/",
34
+
"LWS10-CORE": {
35
+
title: "Linked Web Storage Protocol 1.0",
36
+
href: "https://www.w3.org/TR/lws10-core/",
37
37
publisher: "W3C",
38
38
status: "FPWD",
39
39
},
@@ -58,8 +58,8 @@ <h2>Introduction</h2>
58
58
<p>
59
59
Self-issued identity is important for cases where applications act on their own behalf.
60
60
This includes autonomous bots as well as server-side scripts, among others.
61
-
In these cases, the agent is able to securely manage the private portion of a keypair, which it uses to generate signed JSON Web Tokens (JWT).
62
-
This specification describes how this class of agents can generate authentication credentials that can be used with a Linked Web Storage while using agent identifiers with the `did:key:` method.
61
+
In these cases, the <a>agent</a> is able to securely manage the private portion of a keypair, which it uses to generate signed JSON Web Tokens (JWT).
62
+
This specification describes how this class of <a>agents</a> can generate <a>authentication credentials</a> that can be used with a Linked Web Storage while using <a>agent</a> identifiers with the `did:key:` method.
63
63
</p>
64
64
</section>
65
65
@@ -77,15 +77,15 @@ <h2>Terminology</h2>
77
77
</p>
78
78
79
79
<p>
80
-
The terms "authentication credential" and "authentication suite" are defined by Linked Web Storage Protocol [[!LWS-PROTOCOL]]
80
+
The terms "<dfndata-cite="LWS10-CORE#dfn-agent">agent</dfn>", "<dfndata-cite="LWS10-CORE#dfn-authentication-credential">authentication credential</dfn>", and "<dfndata-cite="LWS10-CORE#dfn-authentication-suite">authentication suite</dfn>" are defined by Linked Web Storage Protocol [[!LWS10-CORE]]
81
81
</p>
82
82
</section>
83
83
84
84
<sectionid="serialization">
85
85
<h2>Authentication Credential Serialization</h2>
86
86
87
87
<p>
88
-
A self-issued authentication credential is serialized as a signed JSON Web Token (JWT). In order to use a JWT as an LWS authentication credential, the following additional requirements apply.
88
+
A self-issued <a>authentication credential</a> is serialized as a signed JSON Web Token (JWT). In order to use a JWT as an LWS <a>authentication credential</a>, the following additional requirements apply.
A self-issued JSON Web Token used as an authentication credential MUST use the <code>urn:ietf:params:oauth:token-type:jwt</code> URI when interacting with an authorization server.
170
+
A self-issued JSON Web Token used as an <a>authentication credential</a> MUST use the <code>urn:ietf:params:oauth:token-type:jwt</code> URI when interacting with an authorization server.
0 commit comments