Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

[Marius Scurtescu <[e-mail]>]

On Tue, Mar 7, 2017 at 10:48 AM, Phil Hunt <[e-mail]> wrote:

> Should SET Token have text forbidding use of nonce?  I can’t see why nonce
> would ever be needed and we can call that out as the method of
> differentiation in the security considerations.
>

Another method of differentiation suggested by William was the value of the
aud claim.

For Id Tokens it is the client id, for SET we could specify that the value
has a specific URN prefix followed by the client id of the receiving party.



>
> Phil
>
> Oracle Corporation, Identity Cloud Services & Identity Standards
> @independentid
> www.independentid.com
> [e-mail]
>
>
>
>
>
>
>
> On Mar 7, 2017, at 10:35 AM, Mike Jones <[e-mail]>
> wrote:
>
> Per my earlier reply to Marius, a SET cannot be confused with an ID Token,
> even if the “events” claim is ignored.  The reply explained:
> “For all response_types except for “code”, the ID Token must have a
> “nonce” claim matching the request in order to be validated.  SETs won’t
> have this claim.  For response_type=code, the ID Token must be retrieved
> from the Token Endpoint to be valid.  But SETs aren’t returned as the
> id_token value from the Token Endpoint.  There isn’t a channel in which an
> attacker can successfully substitute a SET for an ID Token and have it
> validate as an ID Token.”
> I hope people will stop crying wolf, saying that SETs will be confused
> with ID Tokens, because starting with a false premise isn’t a good way to
> further meaningful discussion.
>
> **IF** used in a context in which there might be confusion, which could
> be true for some private access token formats, the SET can always include
> “crit”: [“events”].  I’m fine with the security considerations section
> saying that, provided that doing so is optional in the SET spec.  It’s fine
> for particular SETs to require it, when it’s actually needed.  That’s why
> “crit” is there.
>
> The fact that there are three valid examples of differing levels of
> complexity in the spec is a sign of the strength of the current approach –
> not a sign of a flaw.  Each example includes the information that it needs
> and is simple as possible, given the constraints of use case.  That’s as it
> should be.
>
>                                                        -- Mike
>
> *From:* Phil Hunt [mailto:[e-mail] <[e-mail]>]
> *Sent:* Tuesday, March 7, 2017 10:21 AM
> *To:* Mike Jones <[e-mail]>
> *Cc:* ID Events Mailing List <[e-mail]>
>
> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET
> tokens
>
> Thanks Mike,
>
> Just to be clear. You are expressing a perspective of maintaining the
> exact format as defined by the ID Token and imposing the limit on all other
> Events.
>
> If I understand correctly, JWT (RFC7519) has no such limitation on sub and
> the group *could* choose to profile “sub” to be globally unique for all SET
> Events. Correct?
>
> What I was trying to do was point out the 3 separate subject
> identification formats already in the spec and to ask, is this really
> acceptable (per Yaron’s request)?
>
> You and William have indicated a preference to leave it.
>
> Justin and Benjamin did apparently express some concerns. Can they clarify?
>
> My concern is that we are too compatible with existing code. SETs can
> easily be confused as ID Tokens as existing ID Token parsers will ignore
> the events attribute and will see all the normal claims for an ID Token as
> being present.  If you can address this, then I can live with the status
> quo.
>
> Are they any that have issues with the current draft (in order to get back
> to Yaron’s question)? The current draft allows multiple iss values to
> appear in different places in the JSON structure based on profiling
> specification definition.
>
> Phil
>
> Oracle Corporation, Identity Cloud Services & Identity Standards
> @independentid
> www.independentid.com
> [e-mail]
>
>
>
>
>
>
>
>
> On Mar 7, 2017, at 9:29 AM, Mike Jones <[e-mail]>
> wrote:
>
> No, it’s not possible to require that “sub” be globally unique because for
> important use cases, it’s relative to the issuer.  Trying to force it to be
> a URI would unnecessarily limit the applicability of the SET spec, causing
> some applications to simply decide to not use it as a result.
>
> If some use cases want a kind of logout event that’s issued by a different
> party than the IdP, then the current spec lets that new event be defined.
> It will require more parameters than the current logout event, but that’s
> OK, since it’s used in different contexts.
>
> In my view, it’s not editorially lazy to allow events to define what
> claims they need.  It’s an intentional choice, which enables the simple
> cases to be simply expressed, while also enabling more complicated cases
> carrying more information to be expressed.
>
> Trying to force the simple events use extra syntax only actually needed
> for complicated events would be a severe architectural mistake on our part.
>
>                                                        -- Mike
>
> *From:* Id-event [mailto:[e-mail]
> <[e-mail]>] *On Behalf Of *Phil Hunt
> *Sent:* Tuesday, March 7, 2017 8:13 AM
> *To:* ID Events Mailing List <[e-mail]>
> *Subject:* Re: [Id-event] Thread: Clarifying use of sub and iss in SET
> tokens
>
>
> Just to refresh everyone...
>
> As editor, my feeling is we have no *clean* or *simple* solution because
> we have to use “iss” to mean the issuer of the SET in order to comply with
> JWT and because OIDC conflates assertion issuer with subject issuer, it
> makes it difficult to uniquely identify a “sub” value because some events
> want to use “iss” for 2 purposes (to identify the event issuer vs. the
> subject issuer).
>
> None of the solutions presented are actually easy to explain. So far, I’ve
> sided with Mike and William because they feel it is close enough and it was
> editorially lazy (say nothing). I am worried that this is actually complex
> for developers who do not know the history of how JWTs emerged.
>
> Let’s look at the examples we already have. Notice that in the current
> draft, there are 3 separate ways of expressing the subject of an event….
>
> Scenario 1, the event issuer and subject issuer are the same:
>
>    {
>       "iss": "https://server.example.com",
>       "sub": "248289761001",
>       "aud": "s6BhdRkqt3",
>       "iat": 1471566154,
>       "jti": "bWJq",
>       "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>       "events": {
>         "http://schemas.openid.net/event/backchannel-logout": {}
>       }
>    }
>
> Scenario 2, a relying party is issuing an event, event iss and sub iss are
> different and thus there are repeat iss values:
>
>    {
>      "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>
>      "sub": "248289761001",
>      "iat": 1458496025,
>      "iss": "https://my.examplemed.com",
>      "aud": [
>        "https://rp.example.com"
>      ],
>      "events": {
>        "https://openid.net/heart/specs/consent.html":{
>          "iss":"https://connect.example.com",
>          "consentUri":[
>            "https://terms.examplemed.com/labdisclosure.html#Agree"
>          ]
>        }
>      }
>    }
>
> Scenario  3:  sub is universally unique:
>
>    {
>      "jti": "3d0c3cf797584bd193bd0fb1bd4e7d30",
>      "iat": 1458496025,
>      "iss": "https://scim.example.com",
>      "aud": [
>        "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
>        "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7"
>      ],
>      "sub": "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",
>      "events": {
>        "urn:ietf:params:scim:event:passwordReset":
>          { "id":"44f6142df96bd6ab61e7521d9"},
>        "https://example.com/scim/event/passwordResetExt":
>          { "resetAttempts":5}
>      }
>    }
>
> I believe the current argument is that profiling specs explains how their
> events are to be parsed. This means for multi-event parsers, subject is
> inconsistent and potentially not mappable.  The BackChannel Logout event is
> currently structured for only the OP to issue. However Oracle wants that to
> be bi-directional so that web sites can notify the IDP/OP that the user has
> logged out of a specific web site.  If that happens, BackChannel logout
> will have methods 1 and 2 required.
>
> Would it be possible for events to require that “sub” be globally unique —
> e.g. expressed as a url.  For example, in order for backchannel to be
> issued by an OP or an RP, it would be expressed with sub as a URL ("sub": “
> https://server.example.com/248289761001”,):
>    {
>       "iss": "https://www.exampleapp.com",
>       "sub": “https://server.example.com/248289761001",
>       "aud": "s6BhdRkqt3",
>       "iat": 1471566154,
>       "jti": "bWJq",
>       "sid": "08a5019c-17e1-4977-8f42-65a12843ea02",
>       "events": {
>         "http://schemas.openid.net/event/backchannel-logout": {}
>       }
>
> At least this way iss is never duplicated and sub is always the
> addressable subject of the event regardless of the type of event.  That
> would enable all 3 cases to be expressed one way for all specs.  That seems
> simple to me (at least from how I would define this in the spec).
>
> I had thought Justin was advocating a 4th option which is to always embed
> “sub” and “iss” in the event payload.  So you would end up with something
> like:
>    {
>      "jti": "fb4e75b5411e4e19b6c0fe87950f7749",
>      "iat": 1458496025,
>     * "iss": "https://my.examplemed.com <https://my.examplemed.com/>",*
>      "aud": [
>        "https://rp.example.com"
>      ],
>      "events": {
>        "https://openid.net/heart/specs/consent.html":{
>         * "sub": "248289761001",*
> *         "iss":"https://my.examplemed.com <https://my.examplemed.com/>",*
>          "consentUri":[
>            "https://terms.examplemed.com/labdisclosure.html#Agree"
>          ]
>        }
>      }
>    }
>
> Note that in the above example, “iss” would always be present even if
> “iss” is the *same*.  The rule would be that the iss and sub are in the
> payload and that addresses the subject of the event. The envelope level is
> always reserved for event validation and addressing only.  While some would
> argue this is ugly, I can see some merits as it is at least consistent.
>
>
> Phil
>
> Oracle Corporation, Identity Cloud Services & Identity Standards
> @independentid
> www.independentid.com
> [e-mail]
>
>
>
>
>
>
>
>
> On Mar 7, 2017, at 7:26 AM, Justin Richer <[e-mail]> wrote:
>
> +1
>
> On 3/6/2017 7:55 PM, Benjamin Kaduk wrote:
>
> On 03/06/2017 06:39 PM, Mike Jones wrote:
>
>
> Justin, I suspect you didn’t see my earlier reply to Phil’s note that you
> also replied to, so I’m repeating it here and sending it to you directly.
> (It wouldn’t be the first time that DMARC policies caused some of my
> contributions to be not received by some participants. :-( )
>
> Agreed that this is unclear.  Duplicating information in a protocol *
> *always** introduces an unnecessary error case – the need to define how
> to handle the situation in which two pieces of information that are
> required to be identical are different.  Information in a SET should occur
> at most once.
>
>
>
> That seems a dangerous road to tread, as it requires care in defining
> "information" -- duplicating the same data strings at different levels of
> the hierarchy of a JSON object may very well not be duplicating
> information, due to the extra context provided by the hierarchy.  In my
> mind, it's not a clear case that you should never send the same name/value
> multiple times in different parts of an object, as sometimes it is good to
> keep the semantic separation clear.
>
> -Ben
>
>
>
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>
>
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>
>