OIDC Survey Working Group

[Steven Carmody <>]

Hi,

I took a quick look at this profile:

http://openid.bitbucket.org/HEART/openid-heart-oauth2.html

and saw this text:

> 3.2.1. JWT Bearer Tokens
>
> In order to facilitate interoperability with multiple protected
resources, all HEART-compliant authorization servers issue
cryptographically signed tokens in the JSON Web Token (JWT) format.

I'd note that many OAuth2 deployers cite "its easier to implement than 
SAML" as a reason for using OAuth2; they routinely point to the SAML 
crypto stuff as "too hard for most developers". sigh.

and I *really* like this requirement, in the same section:

> The server MUST issue tokens as JWTs with, at minimum, the following claims:
>
> iss
> The issuer URL of the server that issued the token
> azp
> The client id of the client to whom this token was issued

I also saw that the author of the Heart profile is Justin Richer, the 
primary developer of the MITERD OIDC/OAuth implementation.