oauth-wg/oauth-transaction-tokens

How is the `purp` claim of the Txn-Token defined?

Closed this issue · 4 comments

In PR #57, the token exchange scope parameter is profiled to carry the purpose or intent of the transaction and its value is copied into the purp claim of the resulting Txn-Token.

Is this how we want to handle the 'purp' claim?

I propose that the draft should allow value of the scope claim in the TraT request be independent of the purp claim in the TraT, because the requesting service may not know sufficient details about how the TraT is actually going to be used. For example, the requester may say the scope is "buy stock", whereas the purp claim could have a value like "equity trade"

Ok, so allow the TTS to transform the input scope to the appropriate value (if necessary). I'm ok with that.

Recommended change that the TTS MUST take the value of the scope parameter to determine the purp claim of the TraT.

Based on this feedback, the purp claim is being made REQUIRED.