{"action":"created","issue":{"url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/26","repository_url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs","labels_url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/26/comments","events_url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/26/events","html_url":"https://github.com/smart-on-fhir/fhir-bulk-data-docs/issues/26","id":325457136,"node_id":"MDU6SXNzdWUzMjU0NTcxMzY=","number":26,"title":"What are the requirements around the issuer URL, what is it used for?","user":{"login":"daliboz","id":3018864,"node_id":"MDQ6VXNlcjMwMTg4NjQ=","avatar_url":"https://avatars2.githubusercontent.com/u/3018864?v=4","gravatar_id":"","url":"https://api.github.com/users/daliboz","html_url":"https://github.com/daliboz","followers_url":"https://api.github.com/users/daliboz/followers","following_url":"https://api.github.com/users/daliboz/following{/other_user}","gists_url":"https://api.github.com/users/daliboz/gists{/gist_id}","starred_url":"https://api.github.com/users/daliboz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daliboz/subscriptions","organizations_url":"https://api.github.com/users/daliboz/orgs","repos_url":"https://api.github.com/users/daliboz/repos","events_url":"https://api.github.com/users/daliboz/events{/privacy}","received_events_url":"https://api.github.com/users/daliboz/received_events","type":"User","site_admin":false},"labels":[{"id":899930236,"node_id":"MDU6TGFiZWw4OTk5MzAyMzY=","url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/labels/Auth","name":"Auth","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-22T20:47:56Z","updated_at":"2018-06-07T19:43:21Z","closed_at":null,"author_association":"NONE","body":"Are there requirements we should define for the issuer URL? Initial thoughts:\r\n\r\n- https?\r\n- Recommended methods to confirm domain is owned by the consuming application?\r\n- absolute URL?\r\n\r\nThis is also a bit artificial right now - the issuer doesn't currently serve a purpose if the client id is going to be assigned. We **could** use the issuer URL to help bootstrap trust. EG: A model where the consumer / client offers an https:// endpoint as their “issuer URL”, the EHR then discovers their JSON Web Keys from that URL (for example, at ./.well_known/smart_client_keys). The issuer could replace the client id concept (or it could exist in the background but may not be used in practice) and no longer require registering public keys (and headaches associated with rotation and revocation…).\r\n\r\nOne of the concerns we've discussed with this approach is how this would work with off the shelf OAuth servers."},"comment":{"url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/comments/395541520","html_url":"https://github.com/smart-on-fhir/fhir-bulk-data-docs/issues/26#issuecomment-395541520","issue_url":"https://api.github.com/repos/smart-on-fhir/fhir-bulk-data-docs/issues/26","id":395541520,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NTU0MTUyMA==","user":{"login":"jmandel","id":313089,"node_id":"MDQ6VXNlcjMxMzA4OQ==","avatar_url":"https://avatars0.githubusercontent.com/u/313089?v=4","gravatar_id":"","url":"https://api.github.com/users/jmandel","html_url":"https://github.com/jmandel","followers_url":"https://api.github.com/users/jmandel/followers","following_url":"https://api.github.com/users/jmandel/following{/other_user}","gists_url":"https://api.github.com/users/jmandel/gists{/gist_id}","starred_url":"https://api.github.com/users/jmandel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmandel/subscriptions","organizations_url":"https://api.github.com/users/jmandel/orgs","repos_url":"https://api.github.com/users/jmandel/repos","events_url":"https://api.github.com/users/jmandel/events{/privacy}","received_events_url":"https://api.github.com/users/jmandel/received_events","type":"User","site_admin":false},"created_at":"2018-06-07T19:43:21Z","updated_at":"2018-06-07T19:43:21Z","author_association":"MEMBER","body":"We should mention in the spec, explicitly, that via the `jku` approach clients will be able to rotate their own keys."}}
{"actor":{"display_login":"jmandel"}}