Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt

Samuel Erdtman <> Fri, 11 November 2016 20:21 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C9436129CCA for <>; Fri, 11 Nov 2016 12:21:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id gVJFsTQuvzIW for <>; Fri, 11 Nov 2016 12:21:43 -0800 (PST)
Received: from ( [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 746AA1295AC for <>; Fri, 11 Nov 2016 12:21:42 -0800 (PST)
Received: by with SMTP id c184so438508wmd.0 for <>; Fri, 11 Nov 2016 12:21:42 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4x3Vt8/zMPx9yjgIX8phy/MVkqcgwHL3ki+cnxdrH/Q=; b=ZEDgwHDvQpca+xoz9+EpmLawIwpQ84UQR/DBT4Dk9cT7zoDXvaRvk1JK47AcH6utVU g2kXNXLH7Z+rCBKgLCk3yT72Mknqhfb0VVNYP1lrkyP+C9yWqbEguSuC/w+2JtdnJSPa NSDjZrGi6kxXOxChjcFWVOU8yota2efYgOwwFOZfcHxTuRcEp55DycQxLAuvAMBzu4UI dLsRPqVgzIZQsKC5Lgx71lNcCWlyiDpLvzac5qkObF2V+FAFLrRGCypXiRTNwa5poGVe mfC1ewzDjm2zKfRDJk6BX1vlFz8PvDEF8iieKL4oGMHjGha96/oOYrneW517hzSm0+vB rRyg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4x3Vt8/zMPx9yjgIX8phy/MVkqcgwHL3ki+cnxdrH/Q=; b=UNkKKAK8WpG00A2PHWJAlIoD0I+assZYMw50AlKHNeScpYw5VYTKVi6OE/LnxN9cXM lO4jXn61bc+nrBeCbDd6pLI7Ff2bGxTp1nLXH28odWL3FBr0KbvsOcGdc6rS6D0R65Ro O6n7Kz2ZylYEXcg9t5L5tyHCzsRPVBsGutrOedSlvPfMWmJK8Fb0jNMksXAK8sBp+oaH a9ihbD3coy5TNdK7eefSX3n3BEL7RYCWr0C/WLg996E4Rr+AomyFAbhhiZYx7p0585sD sdfNv7zIdyuuHHfKl+y8ApJtjc+IVW7I8ZkFK9H7UzGu19pDASfsa0sh2b2hwDN37K0K feVg==
X-Gm-Message-State: ABUngvdq0opzXCade9cD4P5xq5SoGimUjish7T8ScNQz+yGi3yTRyGGOcqNXtxbIPyTnJFsgHWo8p+P0SwfrSw==
X-Received: by with SMTP id qo10mr10535637wjc.115.1478895701034; Fri, 11 Nov 2016 12:21:41 -0800 (PST)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: Samuel Erdtman <>
Date: Fri, 11 Nov 2016 20:21:30 +0000
Message-ID: <>
To: Brian Campbell <>
Content-Type: multipart/alternative; boundary="001a11c3ba62eb9b6a05410c3cdd"
Archived-At: <>
Cc: Nat Sakimura via Openid-specs-fapi <>, OAuth WG <>
Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 11 Nov 2016 20:21:45 -0000

You are right one could absolutely use the jwks or jwks_uri attribute, but
from my point of view that would be a workaround.
I would prefer that x5u, x5c and/or x5t was directly available in the
client registration request not via jwks. This would be a cleaner solution.

Best Regards

On Fri, 11 Nov 2016 at 19:13, Brian Campbell <>

> Wouldn't the existing jwks/jwks_uri client metadata parameters suffice?
> Perhaps some guidance in this document about that is warranted. But I don't
> believe anything new is needed for that case.
> On Nov 11, 2016 9:41 AM, "Samuel Erdtman" <> wrote:
> Just a quick comment, see inline
> On Thu, Nov 3, 2016 at 1:41 PM, Justin Richer <> wrote:
> I agree that the client_id is unlikely to be found inside the certificate
> itself. The client_id is issued by the authorization server for the client
> to use at that single AS. The certificate is issued by the CA for the
> client to use on any connection. The AS and CA are not likely to be the
> same system in most deployments. The client will use the same cert across
> multiple connections, possibly multiple AS's, but the same isn't true of
> the client_id.
> Additionally, I think we want to allow for a binding of a self-signed
> certificate using dynamic registration, much the way that we already allow
> binding of a client-generated JWK today.
> Should this specification then extend the dynamic registration
> specification ( with the certificate
> parameter to actually do the registration or is that another document?
> I do think that more examples and guidance are warranted, though, to help
> AS developers.
>  -- Justin
> On 11/2/2016 5:03 PM, Brian Campbell wrote:
> On Sun, Oct 30, 2016 at 9:27 AM, Samuel Erdtman <> wrote:
> I agree it is written so that the connection to the certificate is
> implicitly required but I think it would be better if it was explicit
> written since the lack of a connection would result in a potential security
> hole.
> That's fair. I agree it can be made more explicit and that it be good to
> do so.
> When it comes to the client_id I think subject common name or maybe
> subject serial numbers will be the common location, and I think an example
> would be valuable.
> In my experience and the way we built support for mutual TLS OAuth client
> auth the client_id value does not appear in the certificate anywhere. I'm
> not saying it can't happen but don't think it's particularly common.
> I can look at adding some examples, if there's some consensus that they'd
> be useful and this document moves forward.
> I´m not saying it is a bad Idea just that I would prefer if it was not a
> With very limited addition of code it is just as easy to get the
> certificate attribute for client id as it is to get it from the HTTP
> request data (at least in java). I also think that with the requirement to
> match the incoming certificate in some way one has to read out the
> certificate that was used to establish the connection to do some kind of
> matching.
> Getting data out of the certificate isn't a concern. I just believe that
> the constancy of having the client id parameter is worth the potential
> small amount duplicate data in some cases. It's just a -00 draft though and
> if the WG wants to proceed with this document, we seek further input and
> work towards some consensus.
> _______________________________________________
> OAuth mailing listOAuth@ietf.org