Section on WIMSE Identity

[jsalowey]

This is a section on WIMSE identity format. This may eventually go in another document such as the arch document, but I felt it was an important topic to get a start on.

[yaronf]

Two comments at a high level:

• The section probably belongs in the architecture spec and not here, but I'm OK with it for now.
• I think the SPIFFE Identity is good enough and we can reuse it rather than defining our own, which seems to be an exact clone.

[bc-pi]

https://github.com/yaronf/wimse-s2s/pull/8/files#diff-99cedafce05f1e1fafafbc415a81b34da2df6b52ad13892735fbdab5c43abf08R239 is kinda sorta related even if it doesn't actually say much

edit: now can be found at https://github.com/yaronf/wimse-s2s/blob/main/draft-sheffer-wimse-s2s-protocol.md#iana-considerations

[yaronf]

I think this summarizes well what we discussed yesterday. See my proposed changes.

Remaining question, either for this PR or for an issue: Is the workload identity also used in iss fields? In aud? As the subject of the CA certificate?

[bc-pi]

I'm rather unsure of the wording or terminology but the URI format/namespace/etc is chosen by a higher level entity than the issuer of the token. In the WPT http://www.sheffer.org/wimse-s2s/draft-sheffer-wimse-s2s-protocol.html#section-3.2-2.2.2.1.1 case, for example, the issuer of that token is the workload itself, which has no say over the URIs used in the system. Even the "Identity Server" is probably given a URI as it's identity in the over all system.

Suggested change

This document defines a workload identity as a URI {{!RFC3986}}. This URI is used in the subject fields in the certificates and tokens defined later in this document. This specification treats the URI as opaque. The format of the URI and the namespace for the URI are chosen by the issuer of the token. Other specifications may define specific URI structures for particular use cases. An example of a defined identity format is the SPIFFE ID [SPIFFE-ID](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md).

This document defines a workload identity as a URI {{!RFC3986}}. This URI is used in the subject fields in the certificates and tokens defined later in this document. This specification treats the URI as opaque. The format of the URI and the namespace for the URI are at the discretion of the deployment at large. Other specifications may define specific URI structures for particular use cases. An example of a defined identity format is the SPIFFE ID [SPIFFE-ID](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md).

[bc-pi]

Unresolving conversation as I believe the suggested change or something similar is still needed.

[bc-pi]

for posterity and everything

https://github.com/yaronf/wimse-s2s/pull/7/files#r1659855931

[yaronf]

Approved, assuming Brian's "deployment at large" change is incorporated.