Re: [hrpc] [Iotops] Authorization for IoT devices

[Hannes Tschofenig <[e-mail]>]

Hi Michael,

Remarks below:

-----Original Message-----
From: Michael Richardson <[e-mail]>
Sent: Wednesday, July 28, 2021 3:52 AM
To: Hannes Tschofenig <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [Iotops] Authorization for IoT devices


Hannes Tschofenig <[e-mail]> wrote:
    > Have you tried to use ACE-OAuth, Michael?

My understanding is that it requires a AS to evaluate the request and the generate a ticket/token for the RS.

[Hannes] You have to get the permissions from somewhere since you can hardly create your own permissions...

1) many people perceive the AS as being the cloud component and they don't
   want a cloud part.

[Hannes] The AS may be in the cloud but it may be anywhere else -- whatever is most appropriate in a given deployment.

2) but in any case, it's the form of the rules which the AS evaluates to
   make the authorization decision that I care about.  AFAIK, neither
   OAUTH2 or ACE-OAUTH standardizes that (or intends to).

[Hannes] In deployments today the rules are not standardized because they are configured by the user/admin into the AS. What gets pushed around are permissions, which are defined for specific application domains. These permissions are called "scopes" in the OAuth language. Some of those scopes have been standardized.

There has also been an attempt to standardize more generic ACLs,
see draft-ietf-ace-aif.

    > The work in the ACE group had the goal to develop an authorization
    > solution for IoT devices.

If I'm wrong please correct me.
How would ACE-OAuth identify the local Sheriff?

[Hannes] The purpose of an authorization framework is not to identify a specific person. That's the role of an identity management framework. What ACE/OAuth would be able to do is to give the local sheriff a token so that they can access specific resources. What resources they can access depends on the configured authorization policies.

If you also want to add the identity management piece to ACE/OAuth (which people have obviously done), then you can add OpenID Connect and, for example, FIDO to the mix.

I hope this now makes more sense.

Ciao
Hannes


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.