self-contained token - cover sub claim

[elarlang]

Spin-off from #1967, Post by TobiasAhnoff from #1967 (comment):

---

As far as I can tell this is all covered by other 3.5 requirements, except for 'sub', which covered by

2.11.1

Verify that, if the application supports multiple identity providers (IDPs), the user's identity cannot be spoofed via another supported identity provider (eg. by using the same user identifier). Usually, the application should register and identify the user using a combination of the IdP ID (serving as a namespace) and the user's ID in the IDP.

51.4.4

Verify that if an access control decision requires identifying a unique user from an access token (JWT or related token introspection response), the resource server identifies the user from claims that can not be reassigned to other users. Typically it means using a combination of 'iss' and 'sub' claims.

Perhaps it would make sense to have a requirement in 3.5 for "sub", perhaps change 3.5.6 to only address "sub"?
(this is from https://www.rfc-editor.org/rfc/rfc8725.html#section-3.8)

Verify that the consumers identity (subject) cannot be spoofed via another trusted issuer (eg. by using the same user identifier). For a JWT, if it contains a 'sub' claim, the application must validate that the subject value corresponds to a valid subject and/or issuer-subject pair at the application.

This is basically the same as 2.11.1, but 2.11.1 is focused on IdP and users (not users and clients, consumers) and 51.4.4 has OAuth details, so maybe all three are needed?

[elarlang]

Is there actual difference between proposed requirement for sub and current 2.11.1?

[elarlang]

The context for current V3.5 section is "validate the token before further usage". The sub claim in this context is not usually the information based on that you can say, that this token is not valid - this decision comes later, e. g. when enforcing authorization decisions.

So current decision is, we don't create a new requirement into V3.5, the sub claim will be mentioned in V51.4.3 (#2183).