Re: [core] Conclusion -- Endpoint Client Name / Endpoint Name in RD draft

[peter van der Stok <[e-mail]>]

Hi Hannes, Matthias,

Below a proposal for the security considerations section in the RD draft

the last paragraph:
"Therefore, Endpoints MUST include the
Endpoint identifier in the message, and this identifier
MUST be checked by a resource directory to match the Endpoint identifier
included in the Registration message."

to be replaced with:
"A client MUST obtain an access token from an authorization server 
[draft-ietf-ace-oauth-authz]. For most installations the name of the 
endpoint does not need to be semantically meaningful. For those 
installations the endpoint name MUST be equated to the security 
identifier transported in the access token. For installations where the 
endpoint name must reflect the names of components of the installation, 
the access token MUST contain the values of the endpoint name and the 
optional domain name. A companion document SHOULD describe the format of 
the access tokens, the negotiation between client and Authorization 
server, and the treatment of the token by the RD server."

Will that be sufficient for you; or do you want more detailed text like 
yours below?
Looking forward to your improvements,

thanks,

peter

Hannes Tschofenig schreef op 2018-05-15 10:15:
> @Hannes: Could you provide some more detail, how exactly the Endpoint
> Client Name is extracted from "security context"? Overall, I like
> this, but we should provide concrete text on how people should do it.
> 
> You want to store the security context on the server side and the
> Endpoint Client Name points to the identifier part of it.
> (Other parts of the security context will be relevant for other 
> purposes.)
> 
>  * For PSK-based credential the Endpoint Client Name becomes the PSK 
> Identity
>  * For raw-public keys the Endpoint Client Name becomes the
> SubjectPublicKeyInfo structure (or a hash of it).
>  * For certificates the Endpoint Client Name becomes the leftmost CN
> component of subject name or the SubjectAltName of the certificate,
> depending on what you use.
> 
> Ciao
> Hannes
> 
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose
> the contents to any other person, use it for any purpose, or store or
> copy the information in any medium. Thank you.