From a82ca8aa4d99d8684144006211cb568aa3d9a244 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Tue, 21 Apr 2026 15:53:53 -0700 Subject: [PATCH 1/8] Update openid-caep-1_0.md Add an 'unmanaged' option to current_status in device compliance change event. --- openid-caep-1_0.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index bf3fdaa..ea91635 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -37,6 +37,13 @@ contributor: contribution: | Apoorva defined the `risk-level-change` event. +contributor: + - + ins: Y. Sarig + name: Yair Sarig + org: Omnissa + email: ysarig@omnissa.com + normative: ISO-IEC-29115: target: https://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=45138 @@ -730,6 +737,7 @@ be one of the following strings: > > * `compliant` > * `not-compliant` +> * `unmanaged`: The device is no loner being managed and additional compliance change events may not be sent for this device. The device compliance state is unknown When `event_timestamp` is included, its value MUST represent the time at which the device compliance status changed. From de44c5cc463970c08c87ff559a33ac3af376ad5a Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Tue, 21 Apr 2026 16:06:04 -0700 Subject: [PATCH 2/8] Update openid-caep-1_0.md --- openid-caep-1_0.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index ea91635..4f4b216 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -737,7 +737,7 @@ be one of the following strings: > > * `compliant` > * `not-compliant` -> * `unmanaged`: The device is no loner being managed and additional compliance change events may not be sent for this device. The device compliance state is unknown +> * `unmanaged`: The device is no longer being managed, and additional compliance change events may not be sent for this device. The device’s compliance state is unknown When `event_timestamp` is included, its value MUST represent the time at which the device compliance status changed. From 97001be52a459eacf5f88e214712503200bc4d18 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Wed, 22 Apr 2026 11:55:36 -0700 Subject: [PATCH 3/8] Update openid-caep-1_0.md --- openid-caep-1_0.md | 1 + 1 file changed, 1 insertion(+) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index 4f4b216..d76816d 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -729,6 +729,7 @@ triggered the event. This MUST be one of the following strings: > > * `compliant` > * `not-compliant` +> * `unknown` current_status From 68c03f2085a22de21f65e88c979debb0ce01c336 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Wed, 13 May 2026 11:52:01 -0700 Subject: [PATCH 4/8] Update openid-caep-1_0.md --- openid-caep-1_0.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index d76816d..94fe6bb 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -36,8 +36,6 @@ contributor: email: apoorva.deshpande@okta.com contribution: | Apoorva defined the `risk-level-change` event. - -contributor: - ins: Y. Sarig name: Yair Sarig From 4ef8ac505db0dc8072a504b8c721686ccb8cfef2 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Fri, 15 May 2026 14:21:25 -0700 Subject: [PATCH 5/8] Update openid-caep-1_0.md --- openid-caep-1_0.md | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index 94fe6bb..e06ed37 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -1,9 +1,8 @@ --- -title: OpenID Continuous Access Evaluation Profile 1.0 +title: OpenID Continuous Access Evaluation Profile 1.1 abbrev: CAEP-Spec docname: openid-caep-1_0 -date: 2025-08-29 ipr: none cat: std @@ -712,7 +711,7 @@ Event Type URI: `https://schemas.openid.net/secevent/caep/event-type/device-compliance-change` -Device Compliance Change signals that a device's compliance status has changed. +Device Compliance Change signals that a device's compliance or managed status has changed. The actual reason why the status change occurred might be specified with the nested `reason_admin` and/or `reason_user` claims made in @@ -720,23 +719,31 @@ nested `reason_admin` and/or `reason_user` claims made in ### Event-Specific Claims {#device-compliance-change-claims} +The transmitter MUST send at least one of the current_status or current_management_status claims. + previous_status -> REQUIRED, JSON string: the compliance status prior to the change that +> OPTIONAL, JSON string: the compliance status prior to the change that triggered the event. This MUST be one of the following strings: > > * `compliant` > * `not-compliant` -> * `unknown` current_status -> REQUIRED, JSON string: the current status that triggered the event. This MUST +> OPTIONAL, JSON string: the current status that triggered the event. This MUST be one of the following strings: > > * `compliant` > * `not-compliant` -> * `unmanaged`: The device is no longer being managed, and additional compliance change events may not be sent for this device. The device’s compliance state is unknown + + current_management_status + +> OPTIONAL, JSON string: the current management status that triggered the event. This MUST +be one of the following strings: +> +> * `managed` +> * `not-managed` When `event_timestamp` is included, its value MUST represent the time at which the device compliance status changed. From 46cc00cc227a602d5d58c9fe6401060e13968951 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Fri, 10 Jul 2026 11:04:50 -0700 Subject: [PATCH 6/8] Update openid-caep-1_0.md --- openid-caep-1_0.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openid-caep-1_0.md b/openid-caep-1_0.md index e06ed37..39c7ed4 100644 --- a/openid-caep-1_0.md +++ b/openid-caep-1_0.md @@ -247,6 +247,10 @@ The base URI for CAEP event types is: `https://schemas.openid.net/secevent/caep/event-type/` +Events that were added or updated by this spec will use the following base URI: + +`https://schemas.openid.net/secevent/caep/event-type/v1.1` + ## Session Revoked {#session-revoked} Event Type URI: @@ -709,7 +713,7 @@ the assurance level changed. Event Type URI: -`https://schemas.openid.net/secevent/caep/event-type/device-compliance-change` +`https://schemas.openid.net/secevent/caep/event-type/v1.1/device-compliance-change` Device Compliance Change signals that a device's compliance or managed status has changed. From be44c6588888f43e94fef3c6ff4991c6ea0de5e7 Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Fri, 17 Jul 2026 09:43:42 -0700 Subject: [PATCH 7/8] Rename openid-caep-1_0.md to openid-caep-1_1.md --- openid-caep-1_0.md => openid-caep-1_1.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename openid-caep-1_0.md => openid-caep-1_1.md (100%) diff --git a/openid-caep-1_0.md b/openid-caep-1_1.md similarity index 100% rename from openid-caep-1_0.md rename to openid-caep-1_1.md From e1d3ec381ea80d666ff26c20694dab819378735a Mon Sep 17 00:00:00 2001 From: ysarig75 <64798822+ysarig75@users.noreply.github.com> Date: Tue, 21 Jul 2026 10:42:08 -0700 Subject: [PATCH 8/8] Update openid-caep-1_1.md --- openid-caep-1_1.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openid-caep-1_1.md b/openid-caep-1_1.md index 39c7ed4..33073e0 100644 --- a/openid-caep-1_1.md +++ b/openid-caep-1_1.md @@ -251,6 +251,8 @@ Events that were added or updated by this spec will use the following base URI: `https://schemas.openid.net/secevent/caep/event-type/v1.1` +This spec does not deprecate 1.0 events, you can continue to use those. + ## Session Revoked {#session-revoked} Event Type URI: