Re: [core] Resource Directory Authorization Problems

[Peter van der Stok <[e-mail]>]

Hi Steffi,

thanks for a continued conversation.
The cted text has helped me to understand better the the reach and
purpose of scope parameter.
Stefanie Gerdes schreef op 2018-07-11 14:00:

> Hi Peter,
> 
> <pvds>
> Concerning section 9 "example"
> I will put it above the "security considerations"
> The Example text is meant as a warning shot to RD users, not as a normative text.
> Introducing the scope, as you suggest, validates that approach.
> </pvds>
> The scope defines the authorization, e.g., which resource may be
> accessed, and how (see [1 [1]], [2 [2]]). If I understand section 9.2 correctly,
> the CWT with the new fields authorizes the CT to register the endpoint
> with a certain certificate identifier and sector name. Since these
> fields scope the authorization (define which endpoint the CT is allowed
> to register), I wonder why you cannot use an access token scope for this
> purpose. The RD would then need to validate that the scope covers the
> requested resources (see [2 [2]]), i.e., that the CT is allowed to register
> resources for the endpoint, which is what we aim at, right? Scopes are
> defined by the application (see [3 [3]]), and therefore could be used for
> this purpose.
> 
> <pvds>
> Many thanks for the concrete text portions; that helps enormously.
> next step for me is to modify the example using scope.
> </pvds>
> 
> There are some more open question concerning the authorization that may
> need to be considered here, e.g.: How does the RD server know the
> Authorization Server (they must have a security association)? How does
> the RD server know that a certain AS is authorized to issue access
> tokens for a certain endpoint registration or lookup? Does the RD server
> protect every lookup? If it doesn't, how does the RD server know which
> resources it must protect?
> 
> <pvds>
> I fully agree with your open questions.
> another one: How does the AS server know which endpoint is authorized to specify what in the RD.
> Personally, I still think that an RD security draft (in ACE?) is needed in addition to example text in RD draft.
> </pvds>
> 
> Viele Gruesse
> Steffi
> 
> [1] https://tools.ietf.org/html/rfc6749#section-3.3
> [2] https://tools.ietf.org/html/rfc6749#section-7
> [3] https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-13#section-5.8
 

Links:
------
[1] https://tools.ietf.org/html/rfc6749#section-3.3
[2] https://tools.ietf.org/html/rfc6749#section-7
[3]
https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-13#section-5.8