Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

[Marius Scurtescu <[e-mail]>]

We also talked about adding another claim that defines the type or purpose
of the JWT ("access token", "SET", etc). In a way it is the only sane
option, but it is not addressing existing implementations. Asking
implementors to "be careful" is asking for trouble IMO, especially because
systems evolve by incrementally adding functionality.

Marius

On Wed, Mar 1, 2017 at 12:44 PM, William Denniss <[e-mail]>
wrote:

> OK so perhaps the "URI" thing is overly restrictive.
>
> I guess the security consideration I'm recommending here is that you
> shouldn't have multiple systems that issue JWTs with the same iss/aud
> tuple, except when those systems are tightly coupled (as is the case with
> Connect & Logout).
>
> If a shared issuer is used, then URI-based namespacing is *one* way to
> avoid this, but there are others.
>
> I'm trying to avoid the need for SET to "break" possible use in access
> tokens (one of the stated goals in the original post) – I think having
> advice like this can avoid normative language that changes, and overly
> complicates SET.
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>
>