incorporated subject identifiers from RFC9493

[tulshi]

No description provided.

[tr33]

question to definition of

"format": "ip_address",

the examples only contain IPv4 adresses. But IPv4 is overaged and new systems must be IPv6 compatible.
however, both address formats will remain in the wild for sure a long time.

Question: should the ip address be typed in order to distinguish between multiple versions an formats?
like to distinguish between address netmask (a.b.c.d/24) and IPv6?

also, IPv6 address can be formatted ambiguously (see Issue #46 )

[ogazitt]

I get the value of relying on another established spec for subject identification, but I think there are 2-3 important use-cases missing:

1. "format": "jwt": a base64 encoded JWT
   2."format": "sub": a subject (identity) which is the sub claim from a structured token like a JWT
2. "format": "string": an opaque string (the PEP passes a string that is meaningful in the context of the policy being evaluated - e.g. it's a key that can be looked up by the policy and resolved into a subject)

In addition, would it make sense to allow something like "format": "anonymous" to be able to enforce policy that isn't subject-specific? For example, time of day or IP address range enforcement?

[adeinega]

Suggested change

	RFC9493: # Subject Identifiers for SETs
	RFC9493: # Subject Identifiers for Security Event Tokens

[adeinega]

Suggested change

	The following is a non-normative example of a Subject Identifier Format of type Device Identifier:
	The following is a non-normative example of a Subject Identifier Format of type Device Identifier:

[adeinega]

I would suggest using account, iss_sub or opaque in examples rather than email.

email is a problematic subject identifier because canonicalization algorithms for email addressees aren't that well defined. In some edge cases, it's barely possible to canonicalize email addresses, as a bright example, both [email protected] and [email protected] "represent" the same email address.

[adeinega]

Suggested change

	* Format Description: A value that describes a subject through its IP Address
	* Format Description: A value that describes a subject through its IP address

[davidjbrossard]

I am closing this PR as we've since done major rework to the API that voids the work done in this PR.