Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Nat,

Thanks for the read.

For #1 - should we move that paragraph to section 2 and leave some more generalized statement in section 1?

For #2 - I think the paragraph starting “An outer JSON object that acts…” could be improved. Agreed that something along the lines of defined in JWT should be used.

I recall #3 came up before as part of the delivery spec discussions.  My intent is that when using unsecured JWTs the receiver has to validate via the method of delivery.  E.g. was the JWT delivered over a mutually authenticated channel?

Section 4.1 and 4.2 covers the issue albeit indirectly.

I will go over the text and see what improvement could be made - probably in security considerations.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com <http://www.independentid.com/>phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
> On Aug 2, 2017, at 10:07 AM, Nat Sakimura <sakimura@gmail.com> wrote:
> 
> Thanks, it looks generally good. I had only three small nits. 
> 
> 1) "MUST NOT" in the introduction. 
> ---------------------------------------------------
> I feel that it is better to have this MUST NOT in the main text. The introduction often is skipped by a reader. 
> 
> 2) Potentially missing "defined in " in Section 2 the first bullet
> ------------------------------------------------------------------------------------------------------
> There seems to be missing "defined in" in the sentence "the JWT Token Claims Registry Section 10.1".
> 
> 3) Issuer validation
> ----------------------------------
> I am not sure how to do an issuer validation when using unsecured JWT. 
> Adding more explanation would be beneficial. 
> 
> Best, 
> 
> Nat
> 
> On Wed, Aug 2, 2017 at 1:18 AM M.Lizar@OCG <m.lizar@openconsentgroup.com <mailto:m.lizar@openconsentgroup.com>> wrote:
> +1 on existing text . 
> 
> Agree the document is ready to publish
> 
> - Mark
> 
>> On 31 Jul 2017, at 16:53, Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com>> wrote:
>> 
>> I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.
>>  
>>                                                                 -- Mike
>>  
>> From: Id-event [mailto:id-event-bounces@ietf.org <mailto:id-event-bounces@ietf.org>] On Behalf Of Yaron Sheffer
>> Sent: Monday, July 31, 2017 1:40 PM
>> To: SecEvent <id-event@ietf.org <mailto:id-event@ietf.org>>
>> Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02
> 
>>  
>> This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=34V_EUmT5gCZRmlH04kADdidPjoaKQgvob9KTHAK0Y0&e=>).
>> 
>> Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.
>> 
>> Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.
>> 
>> Thanks,
>>     Dick and Yaron
> 
>> _______________________________________________
>> Id-event mailing list
>> Id-event@ietf.org <mailto:Id-event@ietf.org>
>> https://www.ietf.org/mailman/listinfo/id-event <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e=>
> _______________________________________________
> Id-event mailing list
> Id-event@ietf.org <mailto:Id-event@ietf.org>
> https://www.ietf.org/mailman/listinfo/id-event <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e=>
> -- 
> Nat Sakimura
> 
> Chairman of the Board, OpenID Foundation
> 
> _______________________________________________
> Id-event mailing list
> Id-event@ietf.org <mailto:Id-event@ietf.org>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e=>