Closed issmith1 closed 4 years ago
Yes, it would be better to clarify the nature of the scope data type; it is not a JSON array, but an array as a synonym to "collection", "list", etc, as per RFC6749 -- will do on this repo.
The uastech/standards repo is an entirely different repo holding a mirror of the published remote ID standard. Bugs for that can be filed there, but I don't see any old security definitions.
Discussions reveal that datatype for JWT Claim scope is actually string containing white space separated scopes.
"scope: with an array of strings indicating the scopes granted." Occurs in both RID and ASTM: https://github.com/astm-utm/Protocol/blob/master/utm.yaml#L70 https://github.com/uastech/standards/blob/master/remoteid/augmented.yaml#L1775
Also 'canonical' obviously has old security definitions. Why is this spec still published? https://github.com/uastech/standards/blob/master/remoteid/canonical.yaml