Re: [oauth-ext-review] [IANA #1146174] Expert review for nfv_token (oauth-parameters)

[Miguel Angel Reina Ortega <[e-mail]>]

Hi Hannes, 

Please, find inline some more information about it. Please, note that there's also an answer for your original question which  I think was not answered. 

Please, do not hesitate to come back if you have still some questions.

Best regards.

-----------------------------------------------------------------------------------------------------------------
Miguel Angel Reina Ortega – Testing Expert
Centre for Testing and Interoperability (CTI)
ETSI ● www.etsi.org ● [e-mail]
Phone: [phone] ● Mobile: [phone]

This email may contain confidential information and is intended for 
the use of the addressee only. Any unauthorized use may be unlawful. 
If you receive this email by mistake, please advise the sender
immediately by using the reply facility in your email software. 
Thank you for your co-operation.

-----Original Message-----
From: Hannes Tschofenig <[e-mail]> 
Sent: 18 December 2019 10:35
To: Hannes Tschofenig <[e-mail]>; Miguel Angel Reina Ortega <[e-mail]>
Cc: [e-mail]; Sabrina Tanamal via RT <[e-mail]>
Subject: RE: [IANA #1146174] Expert review for nfv_token (oauth-parameters)

Hi Miguel

IANA pointed me to a newly released specification. I read through the specification and did not find more information about why you need to define a new OAuth parameter for conveying the nfv token in the access token response. Maybe you can point me to the text. The track changes unfortunately did not reveal any relevant changes either.

From what it appears you are happy using MTLS for your purpose, which is great, and you define additional claims that go into the token. IMHO you could just convey the token in the RFC 6749-defined style with the need to define this new parameter.
[NFV] As we define in the document an access token with specific claims, we defined also the nfv_token parameter for the access token request response to clearly notify that the token sent is of type nfv_token as defined in this specification. In the same way open Id has defined an Id_Token for the token they have defined.
Ciao
Hannes

-----Original Message-----
From: oauth-ext-review <[e-mail]> On Behalf Of Hannes Tschofenig
Sent: Wednesday, September 11, 2019 10:51 AM
To: Miguel Angel Reina Ortega <[e-mail]>
Cc: [e-mail]; Sabrina Tanamal via RT <[e-mail]>
Subject: Re: [oauth-ext-review] [IANA #1146174] Expert review for nfv_token (oauth-parameters)

Hi Miguel

Thanks for the registration and sorry for my slow response.

The registration is fine in terms of provided parameters although the reference to the OpenID Connection specification confuses me a little bit.

I do, however, have a question regarding the nfv_token parameter. I looked at your spec and, if I understand it correctly, you want to return a proof-of-possession access token in the token response. What I don't understand is why you need a new parameter for carrying the nfv_token. You could just return the PoP token in the access_token parameter. The profiling of the content of the access token, as you are doing in Section 5.5, is OK.

From a quick look at your specification it appears that you have to register many other parameters with IANA as well, for example the client meta-data and the AS discovery meta-data. Am I wrong?
[NFV] Yes this registry request of these parameters appears in the annex C.4 (Client Registration Metadata registry) and C.5 (OAuth Authorization Server Metadata registry). There is also a new claim for the JSON in C.2 and a registry also for the "Well-Known URIs" Registry

Ciao
Hannes

>
> On behalf of ETSI NFV ISG, I would like to submit the following 
> registration request for the “OAuth Parameters” registry:
>
>
> *   Parameter name: nfv_token
> *   Parameter usage location: Access Token Response
> *   Change controller: ETSI ([e-mail])
>
> *   Specification document(s): clause 5.4
> <https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse>
> of the present ETSI GS NFV-SEC
> 022<https://portal.etsi.org/webapp/WorkProgram/Report_WorkItem.asp?WKI
> _ID=54060>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
oauth-ext-review mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/oauth-ext-review
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.