Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Annabelle,

You are correct #1 isn’t really controversial.

I would look at the minutes of Chicago (see Mike’s presentation) and then the intervening discussing prior to Prague.

I’ve made my concerns clear so I won’t bother repeating them. Your comments suggest some remaining disagreement on what should be in the common SET Token spec vs down stream event profiles. E.g. some have expressed that SET’s job is simply to define the event claim and nothing more.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com <http://www.independentid.com/>phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
> On Aug 2, 2017, at 12:54 PM, Richard Backman, Annabelle <richanna@amazon.com> wrote:
> 
> Phil,
>  
> Can you be more specific about which items have been discussed and what the consensus was? Items 2 and 4 touch on the issuer mismatch matter, but are about clarifying requirements for profiling specifications and so far as I can tell are aligned with the intentions of the current text regarding the handling and interpretation of the “sub” and “iss” claims. Similarly item 6 addresses a profiling specification requirement related to the JWT confusion issue, and does not deviate from the WG consensus as I understand it.
>  
> Item 1, I should hope, is uncontroversial. ☺
>  
> -- 
> Annabelle Richard Backman
> Identity Services
>  
>  
> From: Id-event <id-event-bounces@ietf.org> on behalf of Phil Hunt <phil.hunt@oracle.com>
> Date: Wednesday, August 2, 2017 at 12:22 PM
> To: "Richard Backman, Annabelle" <richanna@amazon.com>
> Cc: SecEvent <id-event@ietf.org>
> Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02
>  
> Annabelle, 
>  
> Thanks for the comments. Many of these items have been discussed at length but many members strongly want to leave as is.  I’ll await further group discussion.
>  
> Re: item 5 - I think I need to re-write that based on feedback from Nat and Marius.  Stay tuned.
>  
> Some of these items are also being discussed in the new JWT BCP document.  Maybe we should hold the SET Token spec so we can refer to the BCP and publish together?  That said, I know many want this finalized ASAP.
>  
> Phil
>  
> Oracle Corporation, Identity Cloud Services Architect & Standards
> @independentid
> www.independentid.com <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com_&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=dr8DHRQ7TCuwn3QgnXZDcyuP9gE-wrdKUmrJ-MSlw5g&s=GVYabcbdptKpdVyAGGSN7wwhQaoUuIbYv3g0_vTWp4o&e=>
> phil.hunt@oracle.com <mailto:phil.hunt@oracle.com>
>  
>> On Aug 2, 2017, at 11:43 AM, Richard Backman, Annabelle <richanna@amazon.com <mailto:richanna@amazon.com>> wrote:
>>  
>> Thanks for all the work on this! It was my understanding that there was an open item from Prague regarding whether to explicitly declare the events’ profiling specification in the SET. Has this been discussed further, or do we still need to close on it?
>>  
>> I have several comments/questions on the current draft:
>>  
>> “Profile Specification” vs. “Profiling Specification”
>> There are a handful of instances of the former that need to be changed to the latter, to match the term as defined in section 1.2:
>> In the “sub” definition in section 1.2
>> In section 3
>> In section 4.2
>> Note regarding Subject Issuer vs. SET Issuer
>> The note regarding the potential for Subject and SET Issuer mismatch (in the “iss” definition in section 1.2) is I think more prescriptive than intended. As written, it mandates placing the Subject’s Issuer in an “iss” value within the event payload, but does not define a format or structure for this value. The logical format – that of the “iss” JWT claim – may or may not be appropriate, depending on the nature of the event and its Subject. I suggest removing this note and covering this concern elsewhere (see #4 below, re: Subject Identification).
>> 
>> 
>> Explicit Typing of SETs
>> I suggest removing the text “if the SET could be used in an application context in which it could be confused with other kinds of JWTs” from the first paragraph of section 2.2, making the secevent+jwt typ header mandatory to implement for all SETs. This conditional is impossible to evaluate, as new types of JWTs will be introduced over time. Just considering existing JWTs, it is a lot to ask for Profiling Spec authors to fully examine the contents and usage of every existing JWT. Mandating use of typ for SETs takes this load off of Profiling Spec authors and insures that future specs have a consistent, reliable way to defend against JWT type confusion.
>> 
>> 
>> Requirements for SET Profiles: Subject Identification
>> I suggest adding text along the lines of “Profiling Specifications MUST define for each of their events how the Subject is identified in the SET, as well as how to address conflicts the event Subject’s Issuer and the SET Issuer if applicable. It is NOT RECOMMENDED for Profiling Specifications to use the “sub” claim in cases where the Subject is not globally unique and has a different Issuer from the SET itself.”
>> 
>> 
>> Guidance for Signing SETs
>> The text in the last paragraph of section 4.1 is unclear to me. It seems to suggest that it is safe to send unsigned JWTs over a channel that lacks transport-layer security, so long as requests include a bearer token or use Basic Authentication. Am I misreading this? It seems counter to the guidance given earlier in the same section.
>> 
>> 
>> Distinguishing SETs from other kinds of JWTs
>> The last sentence of the first paragraph of section 4.7 seems impossible to me. Profiling Specifications cannot be solely responsible for ensuring incompatibility with all future JWT profiles. They can at best ensure incompatibility with existing JWT profiles and be compatible with a standard mechanism by which future JWT profiles may ensure incompatibility (e.g. the “secevent+jwt” typ header). It may be enough to strike the “(or other)” text from this sentence.
>> 
>> 
>>  
>> -- 
>> Annabelle Richard Backman
>> Identity Services
>>  
>>  
>> From: Id-event <id-event-bounces@ietf.org <mailto:id-event-bounces@ietf.org>> on behalf of "M.Lizar@OCG" <m.lizar@openconsentgroup.com <mailto:m.lizar@openconsentgroup.com>>
>> Date: Tuesday, August 1, 2017 at 9:17 AM
>> To: Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com>>
>> Cc: Yaron Sheffer <yaronf.ietf@gmail.com <mailto:yaronf.ietf@gmail.com>>, SecEvent <id-event@ietf.org <mailto:id-event@ietf.org>>
>> Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02
>>  
>> +1 on existing text .  
>>  
>> Agree the document is ready to publish
>>  
>> - Mark
>>  
>>> On 31 Jul 2017, at 16:53, Mike Jones <Michael.Jones@microsoft.com <mailto:Michael.Jones@microsoft.com>> wrote:
>>>  
>>> I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.
>>>  
>>>                                                                 -- Mike
>>>  
>>> From: Id-event [mailto:id-event-bounces@ietf.org <mailto:id-event-bounces@ietf.org>] On Behalf Of Yaron Sheffer
>>> Sent: Monday, July 31, 2017 1:40 PM
>>> To: SecEvent <id-event@ietf.org <mailto:id-event@ietf.org>>
>>> Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02
>>>  
>>> This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=NcFFmLZ6aFDT27EoSTD7rkP2m2nktWqgSd3_CPep8Uw&e=>).
>>> 
>>> Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.
>>> 
>>> Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.
>>> 
>>> Thanks,
>>>     Dick and Yaron
>>> _______________________________________________
>>> Id-event mailing list
>>> Id-event@ietf.org <mailto:Id-event@ietf.org>
>>> https://www.ietf.org/mailman/listinfo/id-event <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=>
>> 
>> 
>> 
>> _______________________________________________
>> Id-event mailing list
>> Id-event@ietf.org <mailto:Id-event@ietf.org>
>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e= <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=> 
> 
>  