subject deviceId - unclear definition

[tr33]

The "subject" has a definition for "deviceId":

deviceId: : OPTIONAL. A field, whose value is of type string, which uniquely identifies the device of the Subject

What exactly is „a device“, its syntax and intended use in the context of a policy?

recommendation:

• remove the "deviceId" attribute until further specified.
• or define a dedicated structure with optional, freely defined attributes where an "deviceId" can be defined as a custom attribute without further specification.

[baboulebou]

This should be left as an open string imho, implementers should be able to use whatever string format here. The provided example has a Mac address, but this could easily be a custom-generated fingerprinting UUID for example, or whatever really.

[davidjbrossard]

Both the subject IP address and device ID should be removed from the spec. These are remnants from the time when the spec pointed to specific use cases but now that AuthZEN has become more general purpose, it's odd that we leave these properties in.

[5.1.1.1. ](https://openid.github.io/authzen/#section-5.1.1.1)[IP Address](https://openid.github.io/authzen/#name-ip-address)
The IP Address of the Subject, identified by an ip_address field, whose value is a textual representation of an IP Address, as defined in Textual Conventions for Internet Network Addresses [[RFC4001](https://openid.github.io/authzen/#RFC4001)].

The following is a non-normative example of a subject which adds the ip_address property:

{
  "type": "user",
  "id": "alice@acmecorp.com",
  "properties": {
    "department": "Sales",
    "ip_address": "172.217.22.14"
  }
}
[Figure 3](https://openid.github.io/authzen/#figure-3): [Example Subject with IP Address](https://openid.github.io/authzen/#name-example-subject-with-ip-add)
[5.1.1.2. ](https://openid.github.io/authzen/#section-5.1.1.2)[Device ID](https://openid.github.io/authzen/#name-device-id)
The Device Identifier of the Subject, identified by a device_id field, whose value is a string representation of the device identifier.

The following is a non-normative example of a subject which adds the device_id property:

{
  "type": "user",
  "id": "alice@acmecorp.com",
  "properties": {
    "department": "Sales",
    "ip_address": "172.217.22.14",
    "device_id": "8:65:ee:17:7e:0b"
  }
}
[Figure 4](https://openid.github.io/authzen/#figure-4): [Example Subject with Device ID](https://openid.github.io/authzen/#name-example-subject-with-device)

We should rewrite these 2 paragraphs as a simple bullet list of example attributes that could be passed in the properties object of the respective categories (subject, resource, action, context...)

See also #46

[davidjbrossard]

On the 8/21 call we agreed to remove sections 5.1.1.1 and 5.1.1.2 that define device ID and IP. We agree that we can later write profiles that define specific properties. This will address issue #46 and #47.