Abstract

This document defines a lightweight, generic, and powerful JSON-based format for expressing claims and requests for claims. The primary driver for Claims 2.0 is the process of negotiation for access authorization defined by the User-Managed Access (UMA) core protocol, but this document is defined as a modular building block that can be used by other protocols as well.

Status

This document is a product of the User-Managed Access Work Group. It is currently under active development. Its latest version can always be found here. See the Change History at the end of this document for its revision number.

Editors

• Eve Maler
• Paul Bryan

Intellectual Property Notice

The User-Managed Access Work Group operates under Kantara IPR Policy - Option Patent & Copyright: Reciprocal Royalty Free with Opt-Out to Reasonable And Non discriminatory (RAND) and the publication of this document is governed by the policies outlined in this option.

Table of Contents

Introduction

This document defines a lightweight, generic, and powerful JSON-based format ([JSON]) for expressing claims and requests for claims, that is, statements in the sense of [IDCclaim]. The primary driver for Claims 2.0 is the process of negotiation for access authorization defined by Step 2 of the User-Managed Access (UMA) core protocol, in which an authorization manager can demand that a requester convey claims on behalf of a requesting party in order to satisfy the polices of an authorizing user. However, this document is defined as a modular building block that can be used by other protocols as well.

Following are design goals of this specification:

• Allows for efficient and consistent processing, marshalling, and unmarshalling
• Lightweight way to express both self-asserted claims and third-party-signed claims
• Allows for variability in the characteristics of claims being requested

Following are non-goals of this specification:

• Complete replacement or equivalent for other claims and signature formats, such as SAML, IMI, or XML Signature
• Protocol for carrying or securing claims and requests for claims for any particular purpose

Conventions

• @@Do we need a proper BNF?
• Members of objects are shown in the required order.
• Italic text stands for a value with the indicated type.
• "(x|y)" represents a literal string with a series of two or more exclusive alternatives of the shown types: as shown here, x or y. When a literal parenthesis mark or vertical bar must appear in such a string, use @@what? instead.
• "*" or {{"string*string"}}represents a literal string that can have any value at the point indicated by the asterisk. When a literal asterisk must appear in such a string, use @@what? instead.

Claims-Related Documents

A higher-level protocol using this specification MUST define where claims-requested and claims documents appear, which of its entities request and provide claims, and to what purpose.

When these documents are exchanged by means of HTTP, their content type MUST be application/json.

claims-requested Document

The top-level object for requesting claims is known as a claims-requested document.

{

}

claims Document

The top-level object for supplying claims is known as a claims document.

{

}

Requested Claim Object

{

}

Claim Object

{

}

Conformance

@@Say something about claims definition and syntactic validity.

References

Normative References

[JSON]
http://www.ietf.org/rfc/rfc4627.txt

Non-Normative References

[IDCclaim]
http://wiki.idcommons.net/Claim

Change History