Re: [OAUTH-WG] New Version Notification for draft-lodderstedt-oauth-jwt-introspection-response-00.txt

[Samuel Erdtman <[e-mail]>]

Hi,

Adding an additional proposal to the table. Mike Jones, Anders Rundgren and
I have created a version of JWS there the signed JSON data does not have to
be Base64url encoded (the JSON is signed using ES6 serialization rules).
One of the benefits to this approach would be that the introspection data
is transferred in cleartext while still fully protected. Since it is
transferred in the response body and not in a URL there is no need for the
Base64url encoding.

The draft can be fond here
https://tools.ietf.org/html/draft-erdtman-jose-cleartext-jws-00

And the example from your draft would look like this (the signature is not
valid, I just copied it from another place)
{
  "sub": "Z5O3upPC88QrAjx00dis",
  "aud": "https://protected.example.net/resource",
  "extension_field": "twenty-seven",
  "scope": "read write dolphin",
  "iss": "https://server.example.com/",
  "active": true,
  "exp": 1419356238,
  "iat": 1419350238,
  "client_id": "l238j323ds-23ij4",
  "username": "jdoe"
  "__cleartext_signature": {
    "alg": "ES256",
    "kid": "example.com:p256",
    "signature": "pXP0GFHms0SntctNk1G1pHZfccVYdZkmAJktY_hpMsI
                  AckzX7wZJIJNlsBzmJ1_7LmKATiW-YHHZjsYdT96JZw"
  }
}




On Mon, Mar 19, 2018 at 11:22 AM, Phil Hunt <[e-mail]> wrote:

> +1.  This is what I expected.
>
> Phil
>
> Oracle Corporation, Identity Cloud Services Architect
> @independentid
> www.independentid.com
> [e-mail]
>
> On Mar 19, 2018, at 10:16 AM, Torsten Lodderstedt <[e-mail]>
> wrote:
>
> We explicitly want the token (JSON object) to be signed not the HTTP
> response. I think using JWS is the most generic way to achieve that goal.
>
> Am 19.03.2018 um 09:57 schrieb Phil Hunt <[e-mail]>:
>
> This draft has similar issues to https://tools.ietf.org/
> html/draft-richer-oauth-signed-http-request-01
>
> Rather than *try* sign HTTP, a signed JWT object is more reliably returned.
>
> Phil
>
>
> On Mar 19, 2018, at 8:25 AM, LARMIGNAT Louis <
> [e-mail]> wrote:
>
> Hi,
>
> The draft *Signing HTTP Messages** (https://tools.ietf.org/html/draft-cavage-http-signatures-09
> <https://tools.ietf.org/html/draft-cavage-http-signatures-09>)* could not
> meet this requirement in a more generic way ?
>
> Regards,
> Louis
>
> *De :* OAuth <[e-mail]> *De la part de* Brock Allen
> *Envoyé :* dimanche 18 mars 2018 20:40
> *À :* Torsten Lodderstedt <[e-mail]>; [e-mail]
> *Objet :* Re: [OAUTH-WG] Fwd: New Version Notification for
> draft-lodderstedt-oauth-jwt-introspection-response-00.txt
>
> Why is TLS to the intospection endpoint not sufficient? Are you thinking
> there needs to be some multi-tenancy support of some kind?
>
> -Brock
>
>
> On 3/18/2018 3:33:16 PM, Torsten Lodderstedt <[e-mail]>
> wrote:
> Hi all,
>
> I just submitted a new draft that Vladimir Dzhuvinov and I have written.
> It proposes a JWT-based response type for Token Introspection. The
> objective is to provide resource servers with signed tokens in case they
> need cryptographic evidence that the AS created the token (e.g. for
> liability).
>
> I will present the new draft in the session on Wednesday.
>
> kind regards,
> Torsten.
>
>
> Anfang der weitergeleiteten Nachricht:
>
> *Von: *[e-mail]
> *Betreff: New Version Notification for
> draft-lodderstedt-oauth-jwt-introspection-response-00.txt*
> *Datum: *18. März 2018 um 20:19:37 MEZ
> *An: *"Vladimir Dzhuvinov" <[e-mail]>, "Torsten
> Lodderstedt" <[e-mail]>
>
>
>
> A new version of I-D, draft-lodderstedt-oauth-jwt-
> introspection-response-00.txt
> has been successfully submitted by Torsten Lodderstedt and posted to the
> IETF repository.
>
> Name:           draft-lodderstedt-oauth-jwt-introspection-response
> Revision: 00
> Title:          JWT Response for OAuth Token Introspection
> Document date:  2018-03-15
> Group:          Individual Submission
> Pages:          5
> URL:            https://www.ietf.org/internet-drafts/draft-
> lodderstedt-oauth-jwt-introspection-response-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-
> lodderstedt-oauth-jwt-introspection-response/
> Htmlized:       https://tools.ietf.org/html/draft-lodderstedt-oauth-
> jwt-introspection-response-00
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-
> lodderstedt-oauth-jwt-introspection-response
> <https://datatracker..ietf.org/doc/html/draft-lodderstedt-oauth-jwt-introspection-response>
>
>
> Abstract:
>   This draft proposes an additional JSON Web Token (JWT) based response
>   for OAuth 2.0 Token Introspection.
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> The information transmitted in the present email including the attachment
> is intended only for the person to whom or entity to which it is addressed
> and may contain confidential and/or privileged material. Any review,
> retransmission, dissemination or other use of, or taking of any action in
> reliance upon this information by persons or entities other than the
> intended recipient is prohibited. If you received this in error, please
> contact the sender and delete all copies of the material.
>
> Ce message et toutes les pièces qui y sont éventuellement jointes sont
> confidentiels et transmis à l'intention exclusive de son destinataire.
> Toute modification, édition, utilisation ou diffusion par toute personne ou
> entité autre que le destinataire est interdite. Si vous avez reçu ce
> message par erreur, nous vous remercions de nous en informer immédiatement
> et de le supprimer ainsi que les pièces qui y sont éventuellement jointes.
>  _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>