On Wed, Apr 24, 2019 at 07:08:25PM +0200, Torsten Lodderstedt wrote: > Hi Sascha, > > I see. I assume every element within the structured scope element to be an > independent scope (value) object and intended to use the name of that object > as kind of content type definition. > > In my last example, the scope is defined as > > "structured_scope":{ > "sign":{ > "credentialID":"qes_eidas", > "documentDigests":[ > { > "hash": > "sTOgwOm+474gFj0q0x1iSNspKqbcse4IeiqlDg/HWuI=", > "label":"Mobile Subscription Contract" > } > ], > "hashAlgorithmOID":"2.16.840.1.101.3.4.2.1" > }, > "payment":{ > "type":"sepa-credit-transfer", > "instructedAmount":{ > "currency":"EUR", > "amount":"123.50" > }, > "debtorAccount":{ > "iban":"DE40100100103307118608" > }, > "creditorName":"Merchant123", > "creditorAccount":{ > "iban":"DE02100100109307118603" > }, > "remittanceInformationUnstructured":"new Smartphone" > } > > This means “sign" and “payment" would determine the scheme of the respective > object. > > What do you think?
I think it reminds me of why draft-ietf-oauth-jwt-bcp recommends using the "typ" header, and all the reasoning we have to do about different types of tokens (not) being replayable at a different endpoint and being interpreted wrongly. -Ben _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth