Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Phil Hunt <phil.hunt@oracle.com> Wed, 02 August 2017 19:22 UTC

Return-Path: <phil.hunt@oracle.com>
X-Original-To: id-event@ietfa.amsl.com
Delivered-To: id-event@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81853131723 for <id-event@ietfa.amsl.com>; Wed, 2 Aug 2017 12:22:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.011
X-Spam-Level:
X-Spam-Status: No, score=-5.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VCmq7JQX4PbE for <id-event@ietfa.amsl.com>; Wed, 2 Aug 2017 12:22:54 -0700 (PDT)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1B9D12ECEF for <id-event@ietf.org>; Wed, 2 Aug 2017 12:22:54 -0700 (PDT)
Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v72JMoMX031290 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 2 Aug 2017 19:22:51 GMT
Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v72JMowO015841 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 2 Aug 2017 19:22:50 GMT
Received: from abhmp0004.oracle.com (abhmp0004.oracle.com [141.146.116.10]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v72JMnkb005096; Wed, 2 Aug 2017 19:22:49 GMT
Received: from [10.0.1.37] (/24.86.190.97) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 02 Aug 2017 12:22:49 -0700
From: Phil Hunt <phil.hunt@oracle.com>
Message-Id: <F2964484-9D65-43E8-80EE-02013B128DFE@oracle.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_95A11930-0FE7-4B86-8586-FF99F0EFACEF"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Wed, 02 Aug 2017 12:22:48 -0700
In-Reply-To: <72B8E7CA-3EB6-4194-BB77-CD46062FDFB7@amazon.com>
Cc: SecEvent <id-event@ietf.org>
To: "Richard Backman, Annabelle" <richanna@amazon.com>
References: <e6649728-f94a-93f5-9885-c948a5b0ed49@gmail.com> <CY4PR21MB0504DEA69A048EADE122995DF5B20@CY4PR21MB0504.namprd21.prod.outlook.com> <D263DE2D-48F7-4AF5-B96F-B83AAED779F6@openconsentgroup.com> <72B8E7CA-3EB6-4194-BB77-CD46062FDFB7@amazon.com>
X-Mailer: Apple Mail (2.3273)
X-Source-IP: aserv0022.oracle.com [141.146.126.234]
Archived-At: <https://mailarchive.ietf.org/arch/msg/id-event/ORUgZzyJbzvKFDfghzs86n4uSkQ>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02
X-BeenThere: id-event@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." <id-event.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/id-event>, <mailto:id-event-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/id-event/>
List-Post: <mailto:id-event@ietf.org>
List-Help: <mailto:id-event-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/id-event>, <mailto:id-event-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Aug 2017 19:22:58 -0000

Annabelle,

Thanks for the comments. Many of these items have been discussed at length but many members strongly want to leave as is.  I’ll await further group discussion.

Re: item 5 - I think I need to re-write that based on feedback from Nat and Marius.  Stay tuned.

Some of these items are also being discussed in the new JWT BCP document.  Maybe we should hold the SET Token spec so we can refer to the BCP and publish together?  That said, I know many want this finalized ASAP.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com <http://www.independentid.com/>phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
> On Aug 2, 2017, at 11:43 AM, Richard Backman, Annabelle <richanna@amazon.com <mailto:richanna@amazon.com>> wrote:
> 
> Thanks for all the work on this! It was my understanding that there was an open item from Prague regarding whether to explicitly declare the events’ profiling specification in the SET. Has this been discussed further, or do we still need to close on it?
>  
> I have several comments/questions on the current draft:
>  
> “Profile Specification” vs. “Profiling Specification”
> There are a handful of instances of the former that need to be changed to the latter, to match the term as defined in section 1.2:
> In the “sub” definition in section 1.2
> In section 3
> In section 4.2
> Note regarding Subject Issuer vs. SET Issuer
> The note regarding the potential for Subject and SET Issuer mismatch (in the “iss” definition in section 1.2) is I think more prescriptive than intended. As written, it mandates placing the Subject’s Issuer in an “iss” value within the event payload, but does not define a format or structure for this value. The logical format – that of the “iss” JWT claim – may or may not be appropriate, depending on the nature of the event and its Subject. I suggest removing this note and covering this concern elsewhere (see #4 below, re: Subject Identification).
> 
> Explicit Typing of SETs
> I suggest removing the text “if the SET could be used in an application context in which it could be confused with other kinds of JWTs” from the first paragraph of section 2.2, making the secevent+jwt typ header mandatory to implement for all SETs. This conditional is impossible to evaluate, as new types of JWTs will be introduced over time. Just considering existing JWTs, it is a lot to ask for Profiling Spec authors to fully examine the contents and usage of every existing JWT. Mandating use of typ for SETs takes this load off of Profiling Spec authors and insures that future specs have a consistent, reliable way to defend against JWT type confusion.
> 
> Requirements for SET Profiles: Subject Identification
> I suggest adding text along the lines of “Profiling Specifications MUST define for each of their events how the Subject is identified in the SET, as well as how to address conflicts the event Subject’s Issuer and the SET Issuer if applicable. It is NOT RECOMMENDED for Profiling Specifications to use the “sub” claim in cases where the Subject is not globally unique and has a different Issuer from the SET itself.”
> 
> Guidance for Signing SETs
> The text in the last paragraph of section 4.1 is unclear to me. It seems to suggest that it is safe to send unsigned JWTs over a channel that lacks transport-layer security, so long as requests include a bearer token or use Basic Authentication. Am I misreading this? It seems counter to the guidance given earlier in the same section.
> 
> Distinguishing SETs from other kinds of JWTs
> The last sentence of the first paragraph of section 4.7 seems impossible to me. Profiling Specifications cannot be solely responsible for ensuring incompatibility with all future JWT profiles. They can at best ensure incompatibility with existing JWT profiles and be compatible with a standard mechanism by which future JWT profiles may ensure incompatibility (e.g. the “secevent+jwt” typ header). It may be enough to strike the “(or other)” text from this sentence.
> 
>  
> -- 
> Annabelle Richard Backman
> Identity Services
>  
>  
> From: Id-event <id-event-bounces@ietf.org <mailto:id-event-bounces@ietf.org>> on behalf of "M.Lizar@OCG" <m.lizar@openconsentgroup.com <mailto:m.lizar@openconsentgroup.com>>
> Date: Tuesday, August 1, 2017 at 9:17 AM
> To: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com>>
> Cc: Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>>, SecEvent <id-event@ietf.org <mailto:id-event@ietf.org>>
> Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02
>  
> +1 on existing text .  
>  
> Agree the document is ready to publish
>  
> - Mark
>  
>> On 31 Jul 2017, at 16:53, Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com>> wrote:
>>  
>> I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.
>>  
>>                                                                 -- Mike
>>  
>> From: Id-event [mailto:id-event-bounces@ietf.org <mailto:id-event-bounces@ietf.org>] On Behalf Of Yaron Sheffer
>> Sent: Monday, July 31, 2017 1:40 PM
>> To: SecEvent <id-event@ietf.org <mailto:id-event@ietf.org>>
>> Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02
>>  
>> This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=NcFFmLZ6aFDT27EoSTD7rkP2m2nktWqgSd3_CPep8Uw&e=>).
>> 
>> Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.
>> 
>> Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.
>> 
>> Thanks,
>>     Dick and Yaron
>> _______________________________________________
>> Id-event mailing list
>> Id-event@ietf.org <mailto:Id-event@ietf.org>
>> https://www.ietf.org/mailman/listinfo/id-event <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=>
> 
> 
> _______________________________________________
> Id-event mailing list
> Id-event@ietf.org <mailto:Id-event@ietf.org>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=>