Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add optional method field for describing the technique used to verify account/URI control #203

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

scouten-adobe
Copy link
Contributor

Closes #202.

@scouten-adobe scouten-adobe self-assigned this Dec 12, 2024
@scouten-adobe scouten-adobe added this to the 1.1 milestone Dec 12, 2024
Copy link

@christianpaquin christianpaquin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that's the right level of flexibility for this initial release.

docs/modules/ROOT/pages/index.adoc Outdated Show resolved Hide resolved
| `cawg.file_verification` | The _<<_identity_provider,identity provider>>_ verified control over a specific URI by providing unique file content which could subsequently be read from that URI. | link:https://docs.digicert.com/en/certcentral/manage-certificates/supported-dcv-methods-for-validating-the-domains-on-ov-ev-tls-ssl-certificate-orders/use-the-http-practical-demonstration-validation-method-to-verify-domain-control.html[Use the HTTP Practical Demonstration DCV method to verify domain control (Digicert)]
| `cawg.email` | The _<<_identity_provider,identity provider>>_ verified control over a specific domain using an e-mail sent to the domain’s administrative contacts. | link:++https://docs.digicert.com/en/certcentral/manage-certificates/supported-dcv-methods-for-validating-the-domains-on-ov-ev-tls-ssl-certificate-orders/use-the-email-dcv-method-to-verify-domain-control.html++[Use Email verification to verify domain control on an OV or EV TLS certificate (Digicert)]
| `cawg.meta_tag` | The _<<_identity_provider,identity provider>>_ verified control over a specific URI by providing unique content to be placed in an HTML `<meta>` tag. | link:https://support.google.com/webmasters/answer/9008080?visit_id=638690062950474628-2219554616&rd=1#meta_tag_verification&zippy=%2Chtml-tag[Verification method details: HTML tag (Google Support)]
| `cawg.oath2` | The _<<_identity_provider,identity provider>>_ verified control over a specific account or resource using link:https://datatracker.ietf.org/doc/html/rfc6749[OAuth2]. |

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if you want to add a cawg.webauthn? It feels like, once it hits broader adoption, it will be a more direct confirmation of identity.

Copy link
Contributor Author

@scouten-adobe scouten-adobe Jan 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's discuss in CAWG meeting. I'm not very familiar with WebAuthn.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add a field to allow identity claims aggregator to describe how a verification was performed
4 participants