Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

["Richard Backman, Annabelle" <[e-mail]>]

Let me restate the iss/sub related items, starting with item 2…

Consider a hypothetical profiling specification where the subject’s issuer is always the audience for the token (e.g. an RP sending events back to an IdP, using the IdP’s own subject identifiers). The draft as written prohibits the profiling specification from simply stating “the subject issuer is the value of the aud claim” and requires that it instead duplicate the aud value in an “iss” attribute in its event payloads. I don’t recall this being the consensus.

Item 4 is an attempt to insure that how the subject for any given event is represented in the token is defined *somewhere*. Feel free to ignore the 2nd sentence of my suggested text (“It is NOT RECOMMENDED for Profiling Specifications…”) if there is disagreement on that recommendation; it’s the first sentence that’s important. As it stands, the draft defines Subject in section 1.2, but makes no comment on how Subject is represented aside from that it might be in the sub claim, and profiling specifications that use sub should declare semantics. My suggestion is to require that profile specifications declare how they represent the subject of their events, however they choose to do it.

--
Annabelle Richard Backman

From: Phil Hunt <[e-mail]>
Date: Wednesday, August 2, 2017 at 1:07 PM
To: "Richard Backman, Annabelle" <[e-mail]>
Cc: SecEvent <[e-mail]>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Annabelle,

You are correct #1 isn’t really controversial.

I would look at the minutes of Chicago (see Mike’s presentation) and then the intervening discussing prior to Prague.

I’ve made my concerns clear so I won’t bother repeating them. Your comments suggest some remaining disagreement on what should be in the common SET Token spec vs down stream event profiles. E.g. some have expressed that SET’s job is simply to define the event claim and nothing more.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com<http://www.independentid.com>
[e-mail]<mailto:[e-mail]>

On Aug 2, 2017, at 12:54 PM, Richard Backman, Annabelle <[e-mail]<mailto:[e-mail]>> wrote:

Phil,

Can you be more specific about which items have been discussed and what the consensus was? Items 2 and 4 touch on the issuer mismatch matter, but are about clarifying requirements for profiling specifications and so far as I can tell are aligned with the intentions of the current text regarding the handling and interpretation of the “sub” and “iss” claims. Similarly item 6 addresses a profiling specification requirement related to the JWT confusion issue, and does not deviate from the WG consensus as I understand it.

Item 1, I should hope, is uncontroversial. ☺

--
Annabelle Richard Backman
Identity Services


From: Id-event <[e-mail]<mailto:[e-mail]>> on behalf of Phil Hunt <[e-mail]<mailto:[e-mail]>>
Date: Wednesday, August 2, 2017 at 12:22 PM
To: "Richard Backman, Annabelle" <[e-mail]<mailto:[e-mail]>>
Cc: SecEvent <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Annabelle,

Thanks for the comments. Many of these items have been discussed at length but many members strongly want to leave as is.  I’ll await further group discussion.

Re: item 5 - I think I need to re-write that based on feedback from Nat and Marius.  Stay tuned.

Some of these items are also being discussed in the new JWT BCP document.  Maybe we should hold the SET Token spec so we can refer to the BCP and publish together?  That said, I know many want this finalized ASAP.

Phil

Oracle Corporation, Identity Cloud Services Architect & Standards
@independentid
www.independentid.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.independentid.com_&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=dr8DHRQ7TCuwn3QgnXZDcyuP9gE-wrdKUmrJ-MSlw5g&s=GVYabcbdptKpdVyAGGSN7wwhQaoUuIbYv3g0_vTWp4o&e=>
[e-mail]<mailto:[e-mail]>

On Aug 2, 2017, at 11:43 AM, Richard Backman, Annabelle <[e-mail]<mailto:[e-mail]>> wrote:

Thanks for all the work on this! It was my understanding that there was an open item from Prague regarding whether to explicitly declare the events’ profiling specification in the SET. Has this been discussed further, or do we still need to close on it?

I have several comments/questions on the current draft:


  1.  “Profile Specification” vs. “Profiling Specification”
There are a handful of instances of the former that need to be changed to the latter, to match the term as defined in section 1.2:

     *   In the “sub” definition in section 1.2
     *   In section 3
     *   In section 4.2

  1.  Note regarding Subject Issuer vs. SET Issuer
The note regarding the potential for Subject and SET Issuer mismatch (in the “iss” definition in section 1.2) is I think more prescriptive than intended. As written, it mandates placing the Subject’s Issuer in an “iss” value within the event payload, but does not define a format or structure for this value. The logical format – that of the “iss” JWT claim – may or may not be appropriate, depending on the nature of the event and its Subject. I suggest removing this note and covering this concern elsewhere (see #4 below, re: Subject Identification).



  2.  Explicit Typing of SETs
I suggest removing the text “if the SET could be used in an application context in which it could be confused with other kinds of JWTs” from the first paragraph of section 2.2, making the secevent+jwt typ header mandatory to implement for all SETs. This conditional is impossible to evaluate, as new types of JWTs will be introduced over time. Just considering existing JWTs, it is a lot to ask for Profiling Spec authors to fully examine the contents and usage of every existing JWT. Mandating use of typ for SETs takes this load off of Profiling Spec authors and insures that future specs have a consistent, reliable way to defend against JWT type confusion.



  3.  Requirements for SET Profiles: Subject Identification
I suggest adding text along the lines of “Profiling Specifications MUST define for each of their events how the Subject is identified in the SET, as well as how to address conflicts the event Subject’s Issuer and the SET Issuer if applicable. It is NOT RECOMMENDED for Profiling Specifications to use the “sub” claim in cases where the Subject is not globally unique and has a different Issuer from the SET itself.”



  4.  Guidance for Signing SETs
The text in the last paragraph of section 4.1 is unclear to me. It seems to suggest that it is safe to send unsigned JWTs over a channel that lacks transport-layer security, so long as requests include a bearer token or use Basic Authentication. Am I misreading this? It seems counter to the guidance given earlier in the same section.



  5.  Distinguishing SETs from other kinds of JWTs
The last sentence of the first paragraph of section 4.7 seems impossible to me. Profiling Specifications cannot be solely responsible for ensuring incompatibility with all future JWT profiles. They can at best ensure incompatibility with existing JWT profiles and be compatible with a standard mechanism by which future JWT profiles may ensure incompatibility (e.g. the “secevent+jwt” typ header). It may be enough to strike the “(or other)” text from this sentence.




--
Annabelle Richard Backman
Identity Services


From: Id-event <[e-mail]<mailto:[e-mail]>> on behalf of "M.Lizar@OCG" <[e-mail]<mailto:[e-mail]>>
Date: Tuesday, August 1, 2017 at 9:17 AM
To: Mike Jones <[e-mail]<mailto:[e-mail]>>
Cc: Yaron Sheffer <[e-mail]<mailto:[e-mail]>>, SecEvent <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

+1 on existing text .

Agree the document is ready to publish

- Mark

On 31 Jul 2017, at 16:53, Mike Jones <[e-mail]<mailto:[e-mail]>> wrote:

I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.

                                                                -- Mike

From: Id-event [mailto:[e-mail]] On Behalf Of Yaron Sheffer
Sent: Monday, July 31, 2017 1:40 PM
To: SecEvent <[e-mail]<mailto:[e-mail]>>
Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02

This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/<https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=NcFFmLZ6aFDT27EoSTD7rkP2m2nktWqgSd3_CPep8Uw&e=>).

Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.

Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.

Thanks,
    Dick and Yaron
_______________________________________________
Id-event mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/id-event<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMGaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=>




_______________________________________________
Id-event mailing list
[e-mail]<mailto:[e-mail]>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=FztSyO9IdR2ly2Cwmu1RhMdXDKw1epjGp_4pel_o_pg&s=YwxW95s5oIBrBLkfuiMUIYuzFIcdnVa8Bn1zvZ4Uurc&e=