Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?

Sergey Beryozkin <sberyozkin@gmail.com> Tue, 19 January 2016 09:59 UTC

Return-Path: <sberyozkin@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 931F51AD065 for <oauth@ietfa.amsl.com>; Tue, 19 Jan 2016 01:59:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TGulclPa0uP8 for <oauth@ietfa.amsl.com>; Tue, 19 Jan 2016 01:59:36 -0800 (PST)
Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88C2B1AD055 for <oauth@ietf.org>; Tue, 19 Jan 2016 01:59:36 -0800 (PST)
Received: by mail-wm0-x22d.google.com with SMTP id n5so102945608wmn.0 for <oauth@ietf.org>; Tue, 19 Jan 2016 01:59:36 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type:content-transfer-encoding; bh=kBQHXCMtmr9ItNY+wwJbJrl9LFBldj+iUv1FjsMYOEU=; b=GU5goMN6sSVhv39feMyy2YnYW0KxHqgbmYisiJng3fQtEMMuJKnpccWRY2ZyHd9+LN XMRFwOtK9hDjJMAJHhk8a3ocyFz2rA3l7tdq+uAfbdn9cMONv7QLqysvaiABUug9OXgY cpe2WvQftKt/p/+LKUmHogUXvjKz+uPP+4+bGk0dU4rN5Pv6MqAMp3MdXf8QRD6xYlFg PbQtNAuI0MlfhByssCHsPahh2whceB7TtAH6cYePouCUlFVYZM17ZZg6OG299CaxD0Ir CAtYECOBtJqv4EfgAN/u2VXQinOUVEhUW2ZPx3vGTLh5MiX5PYCw/greFp2Uhejm+EG6 Laog==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=kBQHXCMtmr9ItNY+wwJbJrl9LFBldj+iUv1FjsMYOEU=; b=LY3VML1yzIVRBsiLlopkLESENukuyQP8Q3IMwx3/IO7/GERTj43LmmvokLQfu2Fg4+ OWAJ03Pu6D2zAZPtvQec8TwmOhovmSA1FUG6Nue+X0PS03cdR1jDVtxuVuJXFjXvSm4m 2kM1k93pnZnPM4oCUH1EI6dSDE9yKPw3CgKnX/mFm5vnl9OyGciJa950aQAZhXaholtK zZXrWi/ljXBFKtiWSJE3NQkwPciFeqe3ek+4BqieIi5plZlttvuY/aQ1CeV85x9AdB0e DSnKxQC0uezvHBJHN0/ADWiB1CO6IVs+/96WO616YNQ2HOO6VCqbCCtxq0XOWMJAXGWS TLFQ==
X-Gm-Message-State: AG10YOQTAgW87y5rfCbRuBfxIpaLQxQCK1uWoTKvD/ebHePtHuBSX0EoHjwDaE4PL5jzDg==
X-Received: by 10.194.188.100 with SMTP id fz4mr24092380wjc.126.1453197575174; Tue, 19 Jan 2016 01:59:35 -0800 (PST)
Received: from [192.168.2.7] ([79.97.184.64]) by smtp.googlemail.com with ESMTPSA id l2sm27711056wjf.15.2016.01.19.01.59.33 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 19 Jan 2016 01:59:34 -0800 (PST)
To: William Denniss <wdenniss@google.com>
References: <78kleo9cmvytysxs1qv8kep0.1453117674832@email.android.com> <569CDE25.90908@gmail.com> <CAAP42hA_3EmJw7fAXSSfg=KynAMF26x6vgm1HyLX1RAS4OpKfQ@mail.gmail.com>
From: Sergey Beryozkin <sberyozkin@gmail.com>
Message-ID: <569E08F6.4040600@gmail.com>
Date: Tue, 19 Jan 2016 09:59:18 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <CAAP42hA_3EmJw7fAXSSfg=KynAMF26x6vgm1HyLX1RAS4OpKfQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/-yzfeoJsQAC1XJYc-tJsNouOLQA>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Jan 2016 09:59:38 -0000

Hi William

Thanks for the advice. FYI we are also on the way to supporting the 
incremental authorization of scopes - thanks for highlighting the 
importance of this process on this list...

Cheers, Sergey
On 19/01/16 03:10, William Denniss wrote:
> Agree with Justin, this is pretty common. We support it for re-auth as
> well as incremental auth (where the user has already approved scope "a"
> and is presented with a request for scopes "a b", they will only need to
> approve scope "b").  In fact if you don't do this, then incremental auth
> isn't really viable.
>
> Regarding security: don't do this for non-confidential clients where you
> can't verify the identity of the app by the redirect (e.g. a localhost
> redirect to an installed app).
>
> On Mon, Jan 18, 2016 at 4:44 AM, Sergey Beryozkin <sberyozkin@gmail.com
> <mailto:sberyozkin@gmail.com>> wrote:
>
>     Hi Justin, thanks for the advice,
>
>     Cheers, Sergey
>
>     On 18/01/16 11:47, Justin Richer wrote:
>
>         Yes, this is common practice. Give the user the option to
>         remember the
>         decision. This is known as "trust on first use", or tofu. Our
>         server,
>         MITREid Connect, implements this as do many others.
>
>
>
>         -- Justin
>
>         / Sent from my phone /
>
>
>         -------- Original message --------
>         From: Sergey Beryozkin <sberyozkin@gmail.com
>         <mailto:sberyozkin@gmail.com>>
>         Date: 1/18/2016 5:59 AM (GMT-05:00)
>         To: oauth@ietf.org <mailto:oauth@ietf.org>
>         Subject: [OAUTH-WG] Can the repeated authorization of scopes be
>         avoided ?
>
>         Hi All
>
>         The question relates to the process of showing the authorization
>         code/implicit flow consent screen to a user.
>
>
>         I'm discussing with my colleagues the possibility of avoiding
>         asking the
>         same user whose session has expired and who is re-authenticating
>         with AS
>         which scopes should be approved.
>
>         For example, suppose the OAuth2 client redirects a user with the
>         requested scope 'a'. The user signs in to AS and is shown a consent
>         screen asking to approve the 'a' scope. The user approves 'a'
>         and the
>         flow continues.
>
>         Some time later, when the user's session has expired, the user is
>         redirected to AS with the same 'a' scope.
>
>         Would it be a good idea, at this point, not to show the user the
>         consent
>         screen asking to approve the 'a' scope again ? For example, AS can
>         persist the fact that a given user has already approved 'a' for
>         a given
>         client earlier, so when the user re-authenticates, AS will use
>         this info
>         and will avoid showing the consent screen.
>
>         That seems to make sense, but I'm wondering, can there be some
>         security
>         implications associated with it, any recommendations/advices
>         will be welcome
>
>         Sergey
>
>         _______________________________________________
>         OAuth mailing list
>         OAuth@ietf.org <mailto:OAuth@ietf.org>
>         https://www.ietf.org/mailman/listinfo/oauth
>
>
>     _______________________________________________
>     OAuth mailing list
>     OAuth@ietf.org <mailto:OAuth@ietf.org>
>     https://www.ietf.org/mailman/listinfo/oauth
>
>


-- 
Sergey Beryozkin

Talend Community Coders
http://coders.talend.com/