{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1953","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1953/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1953/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1953/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1953","id":108284180,"number":1953,"title":"'Anonymous' tokens","user":{"login":"dylanmorley","id":5038454,"avatar_url":"https://avatars2.githubusercontent.com/u/5038454?v=3","gravatar_id":"","url":"https://api.github.com/users/dylanmorley","html_url":"https://github.com/dylanmorley","followers_url":"https://api.github.com/users/dylanmorley/followers","following_url":"https://api.github.com/users/dylanmorley/following{/other_user}","gists_url":"https://api.github.com/users/dylanmorley/gists{/gist_id}","starred_url":"https://api.github.com/users/dylanmorley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dylanmorley/subscriptions","organizations_url":"https://api.github.com/users/dylanmorley/orgs","repos_url":"https://api.github.com/users/dylanmorley/repos","events_url":"https://api.github.com/users/dylanmorley/events{/privacy}","received_events_url":"https://api.github.com/users/dylanmorley/received_events","type":"User","site_admin":false},"labels":[{"id":91417952,"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/feature%20idea%20-%20discuss!","name":"feature idea - discuss!","color":"006b75","default":false}],"state":"open","locked":false,"assignee":{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars3.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false},"assignees":[{"login":"leastprivilege","id":1454075,"avatar_url":"https://avatars3.githubusercontent.com/u/1454075?v=3","gravatar_id":"","url":"https://api.github.com/users/leastprivilege","html_url":"https://github.com/leastprivilege","followers_url":"https://api.github.com/users/leastprivilege/followers","following_url":"https://api.github.com/users/leastprivilege/following{/other_user}","gists_url":"https://api.github.com/users/leastprivilege/gists{/gist_id}","starred_url":"https://api.github.com/users/leastprivilege/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leastprivilege/subscriptions","organizations_url":"https://api.github.com/users/leastprivilege/orgs","repos_url":"https://api.github.com/users/leastprivilege/repos","events_url":"https://api.github.com/users/leastprivilege/events{/privacy}","received_events_url":"https://api.github.com/users/leastprivilege/received_events","type":"User","site_admin":false}],"milestone":null,"comments":66,"created_at":"2015-09-25T08:27:30Z","updated_at":"2017-04-07T12:50:41Z","closed_at":null,"body":"We're working on an ecommerce site that is moving towards a micro service architecture, we need to integrate with 'shopping bag' and 'saved items' services, both of which can be accessed in either an authenticated or unauthenticated state. For example, the customer may save some items, switch them all to bag, then checkout as a guest. \n## The problem\n\nWe want to apply bearer token validation to our APIs so that we have a standard, consistent authentication mechanism - but how should this work when the customer has not signed in? In the above scenario, we're never prompting the user for credentials. \n\nWe don't want to maintain multiple endpoints and have logic about which one to call, we want a single endpoint, secured by bearer token, and the client calls that regardless of their authentication state. So, how do they identify themselves uniquely so they can present a token to an API? \n## Acquire an anonymous token\n\nWe're writing a javascript SDK that we'll drop on relying party pages - it will make use of the Identity Server oidc to determine if the user is authenticated by polling the STS in the normal manner. If they aren't, then we'll make a request for a token and pass in a new scope **anon**\n\nThis would be passed through into DefaultTokenService which would determine that it should issue an anonymous token. We're proposing that this will have a standard set of claims and look something like this\n\n![Image of Anon Token](https://identityresources.blob.core.windows.net/images/anon-token-jwt.png)\n\namr = anon\ndid = device ID, a GUID generated and also applied to the subject\n\nThis can then be used to call APIs that are secured by bearer token, and logic within those APIs can check for the amr claim and take appropriate action.\n\nI hacked in a changeset last night just for proof of concept, and will be working on this today to refine - these are the touchpoints I can see. \n\nhttps://github.com/dylanmorley/IdentityServer3/commit/de073d7b10a542338c211bfe8f6e6404931afb59\n\n@brockallen  @leastprivilege  - Any thoughts on this - do you agree it's a valid use case? Any security concerns you can see? \n\nWe researched AWS cognito when attempting to spec this out - http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.htm and have followed the same pattern regarding amr claim and GUID for identification.\n\nWould you consider bringing 'anon' functionality into the main branch if you're happy with the work we do, or should we branch away?\n\nThanks\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/292527829","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1953#issuecomment-292527829","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1953","id":292527829,"user":{"login":"zoehart","id":23190567,"avatar_url":"https://avatars2.githubusercontent.com/u/23190567?v=3","gravatar_id":"","url":"https://api.github.com/users/zoehart","html_url":"https://github.com/zoehart","followers_url":"https://api.github.com/users/zoehart/followers","following_url":"https://api.github.com/users/zoehart/following{/other_user}","gists_url":"https://api.github.com/users/zoehart/gists{/gist_id}","starred_url":"https://api.github.com/users/zoehart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zoehart/subscriptions","organizations_url":"https://api.github.com/users/zoehart/orgs","repos_url":"https://api.github.com/users/zoehart/repos","events_url":"https://api.github.com/users/zoehart/events{/privacy}","received_events_url":"https://api.github.com/users/zoehart/received_events","type":"User","site_admin":false},"created_at":"2017-04-07T12:50:41Z","updated_at":"2017-04-07T12:50:41Z","body":"@MauricioArroyo Sorry to be a pest, but do you use OIDC UserManager in your solution and, if so, could you share which signin method you use? "}}
{"actor":{"display_login":"zoehart"}}