sub attribute meaning & cardinality

[bigludo7]

@DT-DawidWroblewski another point...

sub attribute should probably be defined in the API documentation/swagger.
I understood this is an uuid to identified the 'transaction' but this need to be clarified

Another point on this sub - as it is not clearly mentioned in IDY.54 is it fair to tag it as mandatory in the response? In Orange implem for example we do not manage it.

Thanks.

[DT-DawidWroblewski]

Hi @bigludo7 !

I (once again ;) ) reviewed MC specs for this purpose.

Sub is a mandatory artifact of MC resource response, as it binds token response (ID Token "sub" field) with resource response.

For reference, please see IDY.03, article 6.2

The “sub” (subject) claim containing the PCR MUST always be returned in the Resource Response so that the Resource Response is tied with the ID Token and the User in this context. This allows the SP to validate the response.

[DT-DawidWroblewski]

MC cleared