Issuer claim in Workload ID Tokens

[arndt-s]

Do Workload ID tokens require an iss claim or is the issuer implicit as part of the WIMSE URI in the sub claim?
Also, does the iss claim add any additional value in scope of this draft aka "Does this draft work without iss claim?"

[PieterKas]

@arndt-s is this addressed in section 4.1 where an iss claim is defined?

[arndt-s]

Section 4.1 came after this issue but I believe the question is still valid.

SPIFFE does not need the issuer as it uses the authority part of the SPIFFE URI as an implicit issuer. However, this makes SPIFFE JWT-SVIDs not compatible with this draft as they do not contain an "iss" claim according to the specification.

Maybe something to check with SPIFFE community though, maybe they'll accept adding it if this would be the only delta.

[yaronf]

@arndt-s The big change from SPIFFE is the cnf construct (the confirmed key), not iss.

[arndt-s]

@yaronf yes and no in my opinion.
Of course, cnf claim is new too, but I believe the complexity in adding the iss claim is higher. Existing deployments out there add this claim on their own with custom logic, custom values to achieve federation. Adding this claim as required and being opinionated by it will probably break a lot of them and will make migration hard.