Variable Claims

Normally, a RP will specify the claims it requires and will get, in return, the corresponding value. For example, an RP may ask for a date of birth claim, and have the date of birth of the user returned as the claim value. However, suppose that users don't want the RP to know their date of birth?

The conventional solution has been to come up with a specific age group claim - 'over 18' or 'over 21' are examples. The problem with this approach is that it does not scale - a user identity would need to support an ever increasing number 'over x' type claims to fulfil the requirements of a range of sites.

A superior approach, brilliantly devised by Sid Sidner is that of variable claims; in this case the RP requests the (commonly available) date of birth claim tagged with a conditional statement - something like 'is over x' where x is the age of interest to the RP. When the IdP gets such a request, it works out the conditional statement and returns a true or false result.

Sidner's original concept was to apply variable claims to financial transactions. For example, a user makes purchases at a web site. On checkout, the site requests a 'payment' claim and sets the total required as the variable part of this claim. When the IdP receives this request it can authorise direct payment, and return the success or failure of the transaction to the site as the claim value.

Note that a major advantage of this approach is that the user is not required to give any bank or card details to the site - so eliminating the possibility of the site losing or making fraudulent use of the user's account details. Another benefit of not requiring the user to enter bank or card details is that these details cannot be captured by malware on the user's device.