Skip to content

Commit

Permalink
Update draft-saxe-wimse-token-exchange-and-translation-protocol.md
Browse files Browse the repository at this point in the history
  • Loading branch information
adeinega authored Jul 1, 2024
1 parent 6bad2ac commit 9e3813a
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions draft-saxe-wimse-token-exchange-and-translation-protocol.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,10 @@ TODO - what context do we enrich tokens with during translation? Embedding token

## Lossy Translation

TODO - define what we mean by lossy. What's lost? Does this mean that some token translations lose valuable information?
TODO - define what we mean by lossy. What's lost? Does this mean that some token translations lose valuable information?
TODO - provide a specific lossy scenario and use case.

Translation may be lossless, such as when exchanging an input token for an output token of the same format, or lossy when exchanging an input token for an output token of a different format. An example of lossy translation is detailed in the example above. In this case, the aud claim of the id token maps to the AWS IAM role used to create the AWS temporary credentials.
Translation may be lossless, such as when exchanging an input token for an output token of the same format, or lossy when exchanging an input token for an output token of a different format. An example of lossy translation is detailed in the example above. In this case, the aud claim of the id token maps to the AWS IAM role used to create the AWS temporary credentials.
The aud (if no azp claim is present), sub, and amr claims are mapped to STS Session Keys with the same name. Other claims in the id token are dropped, resulting in an loss of context.

Lossy translation may impact downstream systems. Implementers must be aware of the risks of lost context through token translation.
Expand Down

0 comments on commit 9e3813a

Please sign in to comment.