IETF Logo Mail Archive

Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens

William Denniss <wdenniss@google.com> Wed, 01 March 2017 20:45 UTC

Return-Path: <wdenniss@google.com>
X-Original-To: id-event@ietfa.amsl.com
Delivered-To: id-event@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 777131296BF for <id-event@ietfa.amsl.com>; Wed, 1 Mar 2017 12:45:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.701
X-Spam-Level:
X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JVm_zyA_q0IB for <id-event@ietfa.amsl.com>; Wed, 1 Mar 2017 12:45:15 -0800 (PST)
Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E113E1296DE for <id-event@ietf.org>; Wed, 1 Mar 2017 12:45:14 -0800 (PST)
Received: by mail-qk0-x234.google.com with SMTP id n127so90962552qkf.0 for <id-event@ietf.org>; Wed, 01 Mar 2017 12:45:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=GWdIQlOHN5ag3MlowJs7IfNumKOX2JBd43MxBXjfr9g=; b=i5F/tOi/qje6ZZXFjYmZ+MHP3ghmz3TKRawBNazES7IssNrL69uxbYbBYuy2bcXATh LrMg1TJ8BYtdHh6gqCenRI8yTXLjhCNNW+cxJeHe9itTHQ/nh4DKXD4nwtww0UpsOLZC ZD6eq6+LhfetuvghqSJcsLL3UulOHw5UriAkEaF1JN7tLctkH4D2CQstE+BOFNJXQBO6 f2EkLpg8N6mwFq32jgCVrK5wtAsGXBDt3mHO1ctc6VfW5LhmutNpfVErUY9KZAJPXnNh LuAxMN4cPyP8XqK47xhXFLp43V5b3G02Klsp+zQL4ZfuTKNqfSp5Kgc52XpfumLpoxWH QsNw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=GWdIQlOHN5ag3MlowJs7IfNumKOX2JBd43MxBXjfr9g=; b=A/RJCm91cRI7W0MBz5TzQfnApmqW1tpGVTbtGgWKQrfY2kqmFkyeyq8QnPn2gMgYTf ce7YwFjJdwZjqecpZmfmmRFKC4he/aeUsk9slDBzebb4gz55Eeypv9/r9uqU3loxoC4z Wse8f0A8cOB1clNd2OrFDkl+0OdvBplXHZ4xtTPF7wCJflKbpOvI/FBNyzaEl2j2FUMY S36Eo/AsjIRrYebasb2wjao0/ZzV01VBN1xSqQzhli3FpLmT02ySdjz8Q39hfiK11oh2 tz01Z2xYKpJ5o4i5d0GlatBzQrZM9KmCPkwA24IjuoHUAO4/Eic6JhEf6O3yxLrFuJ43 RZHw==
X-Gm-Message-State: AMke39l+lKmH3E4WJAjS+2j2RxUv4M4G7Hi0MLFvKwunDZiWv/FRKJwmhggYD8z5kbnw9l3UmuIXJ6XN50jWrBd0
X-Received: by 10.200.44.156 with SMTP id 28mr13084146qtw.48.1488401113414; Wed, 01 Mar 2017 12:45:13 -0800 (PST)
MIME-Version: 1.0
Received: by 10.140.36.203 with HTTP; Wed, 1 Mar 2017 12:44:52 -0800 (PST)
In-Reply-To: <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com>
References: <4611E3C8-9772-44EA-940D-077E1EA6247F@oracle.com> <CAAP42hAPZOHn-37wYrOy7OcvNuqWdXtSSMHxb_AoW7kXeAy4wA@mail.gmail.com> <CY4PR21MB050423CEEA9AB0CC64F0973FF5290@CY4PR21MB0504.namprd21.prod.outlook.com> <CAAP42hD8FbZSKWiorKSZHqiidak4Gf071xKTD2d9EvZa13mt5g@mail.gmail.com> <CY4PR21MB05047835E14B3D375C0538F6F5290@CY4PR21MB0504.namprd21.prod.outlook.com> <CAAP42hB63GC9=7nqiayjnD9i5RG7Yu7CJVCtDZpNWTgLMrDJ8w@mail.gmail.com> <0D17E1B4-D8C1-4241-8D11-8C0C700DD1D5@oracle.com>
From: William Denniss <wdenniss@google.com>
Date: Wed, 01 Mar 2017 12:44:52 -0800
Message-ID: <CAAP42hANJNA62Zkhpv96snpk7O8-cUfwMtooCuhyN242vEMkfA@mail.gmail.com>
To: "Phil Hunt (IDM)" <phil.hunt@oracle.com>
Content-Type: multipart/alternative; boundary="001a11376faca659330549b1638e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/id-event/QhOmyMUa9SaXVKJqGe2hOn_50Jk>
Cc: Mike Jones <Michael.Jones@microsoft.com>, ID Events Mailing List <id-event@ietf.org>
Subject: Re: [Id-event] Thread: Clarifying use of sub and iss in SET tokens
X-BeenThere: id-event@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." <id-event.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/id-event>, <mailto:id-event-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/id-event/>
List-Post: <mailto:id-event@ietf.org>
List-Help: <mailto:id-event-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/id-event>, <mailto:id-event-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Mar 2017 20:45:16 -0000

OK so perhaps the "URI" thing is overly restrictive.

I guess the security consideration I'm recommending here is that you
shouldn't have multiple systems that issue JWTs with the same iss/aud
tuple, except when those systems are tightly coupled (as is the case with
Connect & Logout).

If a shared issuer is used, then URI-based namespacing is *one* way to
avoid this, but there are others.

I'm trying to avoid the need for SET to "break" possible use in access
tokens (one of the stated goals in the original post) – I think having
advice like this can avoid normative language that changes, and overly
complicates SET.

v2.23.0 | Report a Bug | By Email