search

ConsumerDataStandardsAustralia / standards-maintenance

This repository houses the interactions, consultations and work management to support the maintenance of baselined components of the Consumer Data Right API Standards and Information Security profile.
41 stars 9 forks source link

Correct Data Language for Contact Details (profile scope and individual claims) #504

Closed CDR-API-Stream closed 1 year ago

CDR-API-Stream commented 2 years ago

Description

A documentation error was introduced in v1.15.0 of the standards when dealing with the OpenID Connect profile scope and OIDC standard claims. This has caused some confusion for participants implementing individual named claims and the profile scope. This change request seeks to address the documentation error to remove confusion with how ADRs request and DHs authorise individual contact detail claims.

These claims, if supported, must be requested individually and were not intended to be requested using the profile scope as a catch-all substitute. The description for the Contact Details data language incorrectly implies the profile scope can be used as a mechanism to request the standard OIDC contact detail claims as well as the name claims.

No future dated obligation would be provided because it clarifies the optional nature of the contact details claims. This change corrects the change raised in DP216 which has a July 1st 2022 obligation date for the introduction of Profile scope data language.

Area Affected

Data Language Standards: Profile scope.

Change Proposed

In table form, this would be represented as follows:

Data cluster language Permission language Authorisation Scopes Required
Name Full name and title(s) OIDC Profile scope and/or one or more of these standard [OIDC] claims:
  • name
  • given_name
  • family_name
  • updated_at

See 5.4. Requesting Claims using Scope Values on the OIDC website for more information		 Required
Contact Details Phone number;
Email address;
Mail address;		 One or more of these standard [OIDC] claims:
  • email
  • email_verified
  • phone_number
  • phone_number_verified
  • address

See 5.4. Requesting Claims using Scope Values on the OIDC website for more information		 Optional
CDR-API-Stream commented 2 years ago

This documentation fix will be targeted for v1.17.0 release. A staged change will be published this week. If there is any feedback in regards to this item we'd welcome feedback this week.

CDR-API-Stream commented 2 years ago

This change has been staged for review: https://github.com/ConsumerDataStandardsAustralia/standards-staging/compare/release/1.17.0...maintenance/504

perlboy commented 2 years ago

Overall looks good, a few minor things.

code only flow isn't implicitly OpenID (it's OAuth2+PKCE) so perhaps at least the title should drop references to OpenID Connect?

OIDC Profile scope and/or one or more of these standard claims

should probably be

OIDC Profile scope or one or more of these standard claims

Because profile requests all of them and therefore and/or would lead to the question of whether profile scope + first_name claim should result in all claims or just first_name being provided.

The wording from OIDC is:

This scope value requests access to the End-User's default profile Claims, which are:

CDR-API-Stream commented 2 years ago

Thanks @perlboy those suggestions sounds reasonable. They have been reflected in the staged change: https://github.com/ConsumerDataStandardsAustralia/standards-staging/compare/release/1.17.0...maintenance/504