Consider adding a unique token identifier to Session Established CAEP Events
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 78
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
Current State: There is no current way to correlate the SAML assertion or OIDC token that was issued by the IdP and the corresponding RP session that was established as described below:
Currently, the only correlation claim can be ext_id that provides the RP session identifier, but it does not provide the exact token or assertion identifier that establishes that session.
Proposal: Update section 3.6.1 to introduce the additional proposed claim to capture a unique token identifier, id for SAML assertion and jti for OIDC token, and update the example event on section 3.6.2. The proposed claim may be used by the IdP to detect token replays on the RP and / or further analysis.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with section 3.6, especially sections 3.6.1 and 3.6.2 of the linked CAEP specification, and compare the current Session Established claims and example. Update the specification to describe the proposed unique token identifier for SAML assertions and OIDC tokens, then revise the example event accordingly.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100