[kitten] SPN audience claim for GSS BrowserID

Luke Howard <lukeh@padl.com> Mon, 07 October 2013 01:27 UTC

From: Luke Howard <lukeh@padl.com>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Message-Id: <F28F031B-EB8B-44EE-B765-91CA193D7C8F@padl.com>
Date: Mon, 07 Oct 2013 12:26:52 +1100
To: "dev-identity@lists.mozilla.org" <dev-identity@lists.mozilla.org>, "kitten@ietf.org" <kitten@ietf.org>
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
Subject: [kitten] SPN audience claim for GSS BrowserID
Precedence: list

Apologies for the cross-post.

A brief reminder: GSS BrowserID [1] profiles Mozilla Persona for application protocols that use SASL or GSS-API, such as IMAP and SMTP.

The audience in the generated assertion is the “service principal name”, or SPN, which identifies the target service. This is of the form service[/hostname[/instance]], for example “imap/mail.example.com”. Currently we are encoding these as URIs with the prefix urn:ietf:params:gss:spn: (so, in previous example, the “aud” claim would have the value “urn:ietf:params:gss:spn:imap/mail.example.com”).

Rereading draft-ietf-oauth-json-web-token, I note that the audience claim is a StringOrURI, and there's nothing in the BrowserID code that requires the audience to be a URI, at least for internal API consumers.

Any thoughts thus on dropping the URN prefix and placing the unadorned SPN in the audience claim?

-- Luke

[1] http://tools.ietf.org/html/draft-howard-gss-browserid-05

[kitten] SPN audience claim for GSS BrowserID Luke Howard