diff --git a/openid-caep-1_0.md b/openid-caep-1_1.md similarity index 97% rename from openid-caep-1_0.md rename to openid-caep-1_1.md index bf3fdaa..33073e0 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_1.md @@ -1,9 +1,8 @@ --- -title: OpenID Continuous Access Evaluation Profile 1.0 +title: OpenID Continuous Access Evaluation Profile 1.1 abbrev: CAEP-Spec docname: openid-caep-1_0 -date: 2025-08-29 ipr: none cat: std @@ -36,6 +35,11 @@ contributor: email: apoorva.deshpande@okta.com contribution: | Apoorva defined the `risk-level-change` event. + - + ins: Y. Sarig + name: Yair Sarig + org: Omnissa + email: ysarig@omnissa.com normative: ISO-IEC-29115: @@ -243,6 +247,12 @@ The base URI for CAEP event types is: `https://schemas.openid.net/secevent/caep/event-type/` +Events that were added or updated by this spec will use the following base URI: + +`https://schemas.openid.net/secevent/caep/event-type/v1.1` + +This spec does not deprecate 1.0 events, you can continue to use those. + ## Session Revoked {#session-revoked} Event Type URI: @@ -705,9 +715,9 @@ the assurance level changed. Event Type URI: -`https://schemas.openid.net/secevent/caep/event-type/device-compliance-change` +`https://schemas.openid.net/secevent/caep/event-type/v1.1/device-compliance-change` -Device Compliance Change signals that a device's compliance status has changed. +Device Compliance Change signals that a device's compliance or managed status has changed. The actual reason why the status change occurred might be specified with the nested `reason_admin` and/or `reason_user` claims made in @@ -715,9 +725,11 @@ nested `reason_admin` and/or `reason_user` claims made in ### Event-Specific Claims {#device-compliance-change-claims} +The transmitter MUST send at least one of the current_status or current_management_status claims. + previous_status -> REQUIRED, JSON string: the compliance status prior to the change that +> OPTIONAL, JSON string: the compliance status prior to the change that triggered the event. This MUST be one of the following strings: > > * `compliant` @@ -725,12 +737,20 @@ triggered the event. This MUST be one of the following strings: current_status -> REQUIRED, JSON string: the current status that triggered the event. This MUST +> OPTIONAL, JSON string: the current status that triggered the event. This MUST be one of the following strings: > > * `compliant` > * `not-compliant` + current_management_status + +> OPTIONAL, JSON string: the current management status that triggered the event. This MUST +be one of the following strings: +> +> * `managed` +> * `not-managed` + When `event_timestamp` is included, its value MUST represent the time at which the device compliance status changed.