ARAP: which Context members a PDP binds to an approval
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 32/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Domain
- documentation, security
Research direction
Start by reviewing the Authorization-Relevant Context and Approval Scope Extensions requirements in the profile, then read the unresolved discussion in #663 and the scope distinction in #745. The work requires a working group decision before guidance can be drafted, so no implementation entry point is identified. Done means the profile clearly states which Context members a PDP may bind to an approval and how volatility affects approval reuse.
Written by the indexing model from the issue text.
Description
Raised on #663, and the one question there that no PR answers.
Problem
Exact matching over the Authorization-Relevant Context is the interop baseline: "two independently implemented PDP and Access Request Service pairs MUST interoperate on it." Approval Scope Extensions already lets a deployment record a broader or narrower scope, so the default is defeasible, and broader matching sits outside the base guarantee unless another profile defines one.
So the question is not whether to keep the baseline. It is what guidance governs which members a PDP puts in the bound set. A member included because it is security-relevant should make an approval inapplicable when it changes. A member excluded to make approvals reusable is acceptable only where that preserves the intended scope. The profile has guidance against binding volatile members and nothing beyond it.
Recommendation
A working group decision, and then guidance in the profile. #745 holds either way, since it governs what the PEP sends rather than what the PDP binds.
- Dominant language
- TypeScript
- Stars
- 170
- Forks
- 46
- Avg merge
- 18h 5m
- Merged PRs (30d)
- 43
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from openid/authzen
-
Certification Scenario §7.2.2, §7.3.2 and §7.4.2: identical results, or identical fixture results?Possibly taken @alexolivier claimed this 4 days ago. Openauthorization-api certification
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Search interop runner compares results as JSON strings, so member order decides PASS/FAILMay be free again A pull request for this issue was closed without being merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
openid/authzen#693 · 3 comments ·
Maintainers usually reply within 1 day
-
certification
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
openid/authzen#640 · 1 comment ·
Maintainers usually reply within 1 day
-
access-requests
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
openid/authzen#578 · 3 comments ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 35/100
Maintainers usually reply within 1 day
Similar issues
-
Remove unused dependenciesPossibly taken @alastair-smith claimed this today. Openchore other
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
alastair-smith/card-games#384 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
code-yeongyu/senpi#5571 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nexu-io/open-design#9262 · 1 comment ·
Maintainers usually reply within 1 day
-
friction
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
kentcdodds/kody#4753 ·
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 62/100
lingdojo/kana-dojo#33508 · 1 comment · 5 reactions ·
Maintainers usually reply within 1 day