Skip to content

Add an option to report device management status change to device compliance change signal #329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ysarig75 wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add an option to report device management status change to device compliance change signal #329

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a82ca8a
Update openid-caep-1_0.md
ysarig75 Apr 21, 2026
de44c5c
Update openid-caep-1_0.md
ysarig75 Apr 21, 2026
97001be
Update openid-caep-1_0.md
ysarig75 Apr 22, 2026
68c03f2
Update openid-caep-1_0.md
ysarig75 May 13, 2026
4ef8ac5
Update openid-caep-1_0.md
ysarig75 May 15, 2026
46cc00c
Update openid-caep-1_0.md
ysarig75 Jul 10, 2026
be44c65
Rename openid-caep-1_0.md to openid-caep-1_1.md
ysarig75 Jul 17, 2026
e1d3ec3
Update openid-caep-1_1.md
ysarig75 Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 26 additions & 6 deletions openid-caep-1_0.md → openid-caep-1_1.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
---
title: OpenID Continuous Access Evaluation Profile 1.0
title: OpenID Continuous Access Evaluation Profile 1.1

abbrev: CAEP-Spec
docname: openid-caep-1_0
date: 2025-08-29

ipr: none
cat: std
Expand Down Expand Up @@ -36,6 +35,11 @@ contributor:
email: apoorva.deshpande@okta.com
contribution: |
Apoorva defined the `risk-level-change` event.
-
ins: Y. Sarig
name: Yair Sarig
org: Omnissa
email: ysarig@omnissa.com

normative:
ISO-IEC-29115:
Expand Down Expand Up @@ -243,6 +247,12 @@ The base URI for CAEP event types is:

`https://schemas.openid.net/secevent/caep/event-type/`

Events that were added or updated by this spec will use the following base URI:

`https://schemas.openid.net/secevent/caep/event-type/v1.1`

This spec does not deprecate 1.0 events, you can continue to use those.

@jogu jogu Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should clarify who can use them, although maybe some of that belongs in the interop profile. But for here it could be useful to e.g. say if we recommend that transmitters should continue to support the 1.0 events so that 1.0 receivers interoperate with them.


## Session Revoked {#session-revoked}

Event Type URI:
Expand Down Expand Up @@ -705,32 +715,42 @@ the assurance level changed.

Event Type URI:

`https://schemas.openid.net/secevent/caep/event-type/device-compliance-change`
`https://schemas.openid.net/secevent/caep/event-type/v1.1/device-compliance-change`
Comment thread
ysarig75 marked this conversation as resolved.
Resolved

Device Compliance Change signals that a device's compliance status has changed.
Device Compliance Change signals that a device's compliance or managed status has changed.

The actual reason why the status change occurred might be specified with the
nested `reason_admin` and/or `reason_user` claims made in
{{optional-event-claims}}.

### Event-Specific Claims {#device-compliance-change-claims}

The transmitter MUST send at least one of the current_status or current_management_status claims.
Comment thread
ysarig75 marked this conversation as resolved.
Resolved

previous_status

> REQUIRED, JSON string: the compliance status prior to the change that
> OPTIONAL, JSON string: the compliance status prior to the change that
triggered the event. This MUST be one of the following strings:
>
> * `compliant`
> * `not-compliant`

current_status

> REQUIRED, JSON string: the current status that triggered the event. This MUST
> OPTIONAL, JSON string: the current status that triggered the event. This MUST
Comment thread
ysarig75 marked this conversation as resolved.
Resolved
be one of the following strings:
>
> * `compliant`
> * `not-compliant`

current_management_status

> OPTIONAL, JSON string: the current management status that triggered the event. This MUST
be one of the following strings:
>
> * `managed`
> * `not-managed`

When `event_timestamp` is included, its value MUST represent the time at which
the device compliance status changed.

Expand Down
Loading