Re: [OAUTH-WG] JWT - scope claim missing

John Bradley <ve7jtb@ve7jtb.com> Thu, 28 February 2013 17:34 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29B3721F8BF0 for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 09:34:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.394
X-Spam-Level:
X-Spam-Status: No, score=-3.394 tagged_above=-999 required=5 tests=[AWL=0.204, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GrcFXkdwq6S5 for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 09:34:32 -0800 (PST)
Received: from mail-pa0-f41.google.com (mail-pa0-f41.google.com [209.85.220.41]) by ietfa.amsl.com (Postfix) with ESMTP id 54C4621F8BEC for <oauth@ietf.org>; Thu, 28 Feb 2013 09:34:32 -0800 (PST)
Received: by mail-pa0-f41.google.com with SMTP id fb11so1274248pad.0 for <oauth@ietf.org>; Thu, 28 Feb 2013 09:34:32 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:content-type:mime-version:subject:from:in-reply-to:date :cc:message-id:references:to:x-mailer:x-gm-message-state; bh=e/JIuWzNuR+u0P/MObBiv0/L+VPZIPdQaQa4u5dm/Ko=; b=BKknCj9TBOOP1ctTJ7lZoNayHqRXB41Qi7QSjTMGJbGtz+BBMIdnUmGYknhckL86Az RQlW1id22T2dWDFeCKHzAuZXnVX8eHcLxLnWUVfcUsXYyqOxf5evVsGsZfRtCWwybayI Ht6j7w/5Q1HnVzR5MYGEvo9fXZgDDHxGKAKtvHLOXAcjzb+Z5hsoz7lTXKSLoAoT+cmY 3+evet+6v9z3yG7XoP+63G8aMsg6rZuP1ntHlUqrIob++kQrTj44gJ2DoBgKnh3E5crF ovpzPTTrdDUP30l+mPJS3mVZUIK/1d1zGbXs0JpxWq147nmn2Ix5vCcGtokj2gM+ve0H 86VQ==
X-Received: by 10.68.143.167 with SMTP id sf7mr10304089pbb.21.1362072872112; Thu, 28 Feb 2013 09:34:32 -0800 (PST)
Received: from [192.168.41.99] (ip-64-134-220-138.public.wayport.net. [64.134.220.138]) by mx.google.com with ESMTPS id zm1sm8999512pbc.26.2013.02.28.09.34.28 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 28 Feb 2013 09:34:30 -0800 (PST)
Content-Type: multipart/signed; boundary="Apple-Mail=_1F5C6D51-B15F-4EC9-BECD-C8B29BCC9943"; protocol="application/pkcs7-signature"; micalg=sha1
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <39016EC6-D3E3-4812-9825-B1C95A5D9AED@oracle.com>
Date: Thu, 28 Feb 2013 09:34:27 -0800
Message-Id: <637841B2-C50C-444D-960F-CABB0CEC889D@ve7jtb.com>
References: <0EC2404F-E3C5-4AD1-88B4-E74AA0394DD9@gmx.net> <C75E4871-E907-4EF7-BAF0-9D1A172D581B@ve7jtb.com> <CA6A6425-D0CE-469F-B51E-9F296DA8041C@oracle.com> <CA+k3eCREgN+6z+U=jjJcPo0nZVR0GWn5zXeecZRO+rg=xd-gZg@mail.gmail.com> <39016EC6-D3E3-4812-9825-B1C95A5D9AED@oracle.com>
To: Phil Hunt <phil.hunt@oracle.com>
X-Mailer: Apple Mail (2.1499)
X-Gm-Message-State: ALoCoQmJ2stAk9wid4P15cShs99eUFz87L57MMKCJNtN1oB1ze5MKRAHF6YyUMFczFleGgKq2R7P
Cc: "oauth@ietf.org WG" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] JWT - scope claim missing
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Feb 2013 17:34:33 -0000

Yes IETF WG politics:)

Should JWT and JOSE  be together ?  Through a number of twists and turns they are not, lets not go there.

But to the point a number of us have made JWT is used in OAuth for more than access tokens.  
Currently it's only use in OAuth is in the JWT assertions profile that has nothing to do with access tokens.

John B.

On 2013-02-28, at 9:27 AM, Phil Hunt <phil.hunt@oracle.com> wrote:

> Am I missing something. JWT is firstly an oauth spec. Otherwise why isnt it in jose wg?
> 
> Phil
> 
> Sent from my phone.
> 
> On 2013-02-28, at 8:44, Brian Campbell <bcampbell@pingidentity.com> wrote:
> 
>> I think John's point was more that scope is something rather specific to an OAuth access token and, while JWT is can be used to represent an access token, it's not the only application of JWT. The 'standard' claims in JWT are those that are believed (right or wrong) to be widely applicable across different applications of JWT. One could argue about it but scope is probably not one of those.
>> 
>> It would probably make sense to try and build a profile of JWT specifically for OAuth access tokens (though I suspect there are some turtles and dragons in there), which might be the appropriate place to define/register a scope claim.
>> 
>> 
>> On Thu, Feb 28, 2013 at 9:24 AM, Phil Hunt <phil.hunt@oracle.com> wrote:
>> Are you advocating TWO systems? That seems like a bad choice.
>> 
>> I would rather fix scope than go to a two system approach.
>> 
>> Phil
>> 
>> Sent from my phone.
>> 
>> On 2013-02-28, at 8:17, John Bradley <ve7jtb@ve7jtb.com> wrote:
>> 
>> > While scope is one method that a AS could communicate authorization to a RS, it is not the only or perhaps even the most likely one.
>> > Using scope requires a relatively tight binding between the RS and AS,  UMA uses a different mechanism that describes finer grained operations.
>> > The AS may include roles, user, or other more abstract claims that the the client may (god help them) pass on to EXCML for processing.
>> >
>> > While having a scopes claim is possible, like any other claim it is not part of the JWT core security processing claims, and needs to be defined by extension.
>> >
>> > John B.
>> > On 2013-02-28, at 2:29 AM, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
>> >
>> >> Hi Mike,
>> >>
>> >> when I worked on the MAC specification I noticed that the JWT does not have a claim for the scope. I believe that this would be needed to allow the resource server to verify whether the scope the authorization server authorized is indeed what the client is asking for.
>> >>
>> >> Ciao
>> >> Hannes
>> >>
>> >> _______________________________________________
>> >> OAuth mailing list
>> >> OAuth@ietf.org
>> >> https://www.ietf.org/mailman/listinfo/oauth
>> >
>> > _______________________________________________
>> > OAuth mailing list
>> > OAuth@ietf.org
>> > https://www.ietf.org/mailman/listinfo/oauth
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>