Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AE21120052 for ; Mon, 22 Jul 2019 09:26:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z0T3KiL35epc for ; Mon, 22 Jul 2019 09:26:01 -0700 (PDT) Received: from smtprelay02.ispgateway.de (smtprelay02.ispgateway.de [80.67.31.25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D9D0120284 for ; Mon, 22 Jul 2019 09:26:01 -0700 (PDT) Received: from [84.158.229.114] (helo=[192.168.71.123]) by smtprelay02.ispgateway.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92) (envelope-from ) id 1hpb8Q-0000r8-AB; Mon, 22 Jul 2019 18:25:58 +0200 From: Torsten Lodderstedt Message-Id: <5078F754-28C0-4D19-8F65-FC9F7C8A8DEF@lodderstedt.net> Content-Type: multipart/signed; boundary="Apple-Mail=_7B555A2A-9E3D-4DBF-A3AB-F2049B13F058"; protocol="application/pkcs7-signature"; micalg=sha-256 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Mon, 22 Jul 2019 18:25:57 +0200 In-Reply-To: Cc: OAuth WG To: Vittorio Bertocci References: <156371372426.20589.10365011724092335159@ietfa.amsl.com> <4A5EA92D-0B76-4383-9827-CF49CC363AA6@lodderstedt.net> X-Mailer: Apple Mail (2.3445.104.11) X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC5uZXQ= Archived-At: Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-access-token-jwt-01.txt X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jul 2019 16:26:04 -0000 --Apple-Mail=_7B555A2A-9E3D-4DBF-A3AB-F2049B13F058 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 22. Jul 2019, at 17:13, Vittorio Bertocci = wrote: >=20 > Thank you Torsten for the prompt review and insightful comments! >=20 > 2.2.1 - excellent point. I added the suggested language. >=20 > 2.2.2 - interesting. I did think of cases similar to profile in OIDC, = where the effect of the request is influencing the layout of the = resulting idtoken, but concluded that it didn't apply as is for access = tokens. Given that you have direct knowledge of such cases in the wild, = I am happy to relax the MUST into a SHOULD. >=20 > 5. - this is going to be problematic in the wild. For example, in the = azure AD world a registered application can play both the role of an API = and a client; and requests for tokens targeting the app can use any = identifier assigned to the app. That means that although idtokens will = only be issued if the request identifies the client via clientID, access = tokens requests for it will be honored (and reflected in aud) both in = the case the resource parameter contains the clientID or the API URI of = the target application. Interesting and (in my opinion) reasonable. Out of the top of my head I = don=E2=80=99t see how this has a negative security impact since the = recipient is always the same service.=20 > In fact I suspect that the most recent version of the service uses the = clientID as preferred identifier, if not the only one. Mike/Tony can = confirm or deny. > As a compromise, we could add language in the spec that recommends the = use of a unique audience when viable, as an extra measure in case the = typ value isn't honored. WDYT? Having a unique audiences at least for different services is key. In fact, I=E2=80=99m concerned about JWT confusion in OIDC RPs in the = wild that do generally not honor the type (as long as we do not update = OIDC Core to require this and it is being adopted). I think since your = draft requires both, iss and aud to be present, this threat is being = dealt with. Additionally stating that unique audiences shall be used for = different services should be ok. > =20 >=20 > On Mon, Jul 22, 2019 at 7:01 AM Torsten Lodderstedt = wrote: > Hi Vittorio, >=20 > thanks for contributing this specification. It fills a further gap in = the OAuth universe :-) >=20 > Here are my comments: >=20 > - 2.2.1 there are other sources for identity claims, e.g. = https://openid.net/specs/openid-connect-4-identity-assurance-1_0.html.=20= >=20 > I recommend to open the clause >=20 > "Any additional attributes whose semantic is well described by the > attributes description found in section 5.1 of [ > OpenID.Core] SHOULD > be codified in JWT access tokens via the corresponding claim names = in > that section of the OpenID Connect specification. The same holds = for > attributes defined in [RFC7662]." >=20 > by adding=20 >=20 > "and other identity related specifications.=E2=80=9D=20 >=20 > Alternatively, the draft could also refer to the IANA =E2=80=9COAuth = Token Introspection Response=E2=80=9D registry as source for JWT claims. >=20 > - 2.2.2.=20 >=20 > "If an authorization request includes a scope parameter, the > corresponding issued JWT access token MUST include a scope claim as > defined in section 4.2 of [TokenExchange]." >=20 > Why do you establish such a strong link between the scope in the = authorization request and the access token? I=E2=80=99m aware of = implementations that map scope values to audience values and therefore = do not carry the scope value to the resource server. I suggest to soften = this requirement and make it a recommendation.=20 >=20 > - 5.=20 >=20 > "The JWT access token data layout described here is very similar to = the one of the id_token as defined by [OpenID.Core]. Without the > explicit typing required in this profile, in line with the = recommendations in [JWT.BestPractices] there would be the risk of > attackers using JWT access tokens in lieu of id_tokens." >=20 > I like this practice but it is not established yet in the OpenID = Connect universe. This means any OIDC RP will process an access token = because it will just ignore the type header.=20 >=20 > draft-ietf-oauth-jwt-introspection-response therefore gives = recommendation on how to use iss and aud claim to prevent JWT abuse = (https://tools.ietf.org/html/draft-ietf-oauth-jwt-introspection-response-0= 4#section-6.1).=20 >=20 > Mapping this pattern to JWTs as access token requires that there must = not be the same aud value for a resource server and any other JWT = consumer, e.g. an OpenID Connect RP.=20 >=20 > kind regards, > Torsten.=20 >=20 > > On 21. Jul 2019, at 14:55, internet-drafts@ietf.org wrote: > >=20 > >=20 > > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > > This draft is a work item of the Web Authorization Protocol WG of = the IETF. > >=20 > > Title : JSON Web Token (JWT) Profile for OAuth 2.0 = Access Tokens > > Author : Vittorio Bertocci > > Filename : draft-ietf-oauth-access-token-jwt-01.txt > > Pages : 15 > > Date : 2019-07-20 > >=20 > > Abstract: > > This specification defines a profile for issuing OAuth2 access = tokens > > in JSON web token (JWT) format. Authorization servers and = resource > > servers from different vendors can leverage this profile to issue = and > > consume access tokens in interoperable manner. > >=20 > >=20 > > The IETF datatracker status page for this draft is: > > https://datatracker.ietf.org/doc/draft-ietf-oauth-access-token-jwt/ > >=20 > > There are also htmlized versions available at: > > https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-01 > > = https://datatracker.ietf.org/doc/html/draft-ietf-oauth-access-token-jwt-01= > >=20 > > A diff from the previous version is available at: > > = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-oauth-access-token-jwt-01 > >=20 > >=20 > > Please note that it may take a couple of minutes from the time of = submission > > until the htmlized version and diff are available at tools.ietf.org. > >=20 > > Internet-Drafts are also available by anonymous FTP at: > > ftp://ftp.ietf.org/internet-drafts/ > >=20 > > _______________________________________________ > > OAuth mailing list > > OAuth@ietf.org > > https://www.ietf.org/mailman/listinfo/oauth >=20 --Apple-Mail=_7B555A2A-9E3D-4DBF-A3AB-F2049B13F058 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC0ow ggUyMIIEGqADAgECAhEAh3cjdwfbVS49xtpMKQd5tjANBgkqhkiG9w0BAQsFADCBljELMAkGA1UE BhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYG A1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGllbnQgQXV0aGVu dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTAeFw0xOTAxMzAwMDAwMDBaFw0yMDAxMzAyMzU5 NTlaMCgxJjAkBgkqhkiG9w0BCQEWF3RvcnN0ZW5AbG9kZGVyc3RlZHQubmV0MIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1iT7e+ZazS5uGQ2/oV6rKb+dLiC1cbVCWN1TEV1XemJP68/I 91+YUtc87N8M46QgGHN25FeM8xaWL6Q83aArs/nnuYx26+x0Em5Z8cqcAe+i1JLbvxt5j47h+5ii ZErQld2GCf7EsW5YO+UoNws9ZMkcOHp77qSUuva0mDxitDpsMdlVIbYTkOIW2/x7NinUBBSvpO0b xlejSGukCX73pTUWPBK3kznd3wqg7SaiqZH+1g/1cQxMD8Wk8S1QPO3AB2xA7hES4EjWFZ7a9HhX 5VMRyJlsEDb1KJAot7cypJcfDhCJwG8De5hSEsW5kEWL0h+AOFXcB+JQzLW0sdSVxwIDAQABo4IB 5jCCAeIwHwYDVR0jBBgwFoAUCcDy/AvalNtf/ivfqJlCz8ngrQAwHQYDVR0OBBYEFBnmpsoJu2zU GrbmQoBZG6uxqdNRMA4GA1UdDwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMCAGA1UdJQQZMBcGCCsG AQUFBwMEBgsrBgEEAbIxAQMFAjARBglghkgBhvhCAQEEBAMCBSAwQAYDVR0gBDkwNzA1BgwrBgEE AbIxAQIBAQEwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0fBFMw UTBPoE2gS4ZJaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGlj YXRpb25hbmRTZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAChklo dHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNl Y3VyZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAiBgNV HREEGzAZgRd0b3JzdGVuQGxvZGRlcnN0ZWR0Lm5ldDANBgkqhkiG9w0BAQsFAAOCAQEAKEl922ls OY5xPqRLJUKLCshBzoNcJ6UDXI4CwCClc4E3yIDQg09zpK0UdrFW0cU8qFc7iXRixKdU361AADG+ SB/N9ttU40JB7HgJYLhHYijKjXwobUGohyhZRv00PvAS6qV8Xevj2OGZ1V/w3VPJxEyYPpSCFJ0g qUut0Nt6qse67hS5+BZsJp5d+v/Ozo9UGjLa658ZovxG7/CsKZXF6AQe5fNPhpWAfyVfnTHwQpqm 5jQYPX3fB3k3JQv/IuB2CIENxgQoYpfXg37sSbcdkeWQu4ouiRlTwTfLDI2pfuxRQLJzoCxIYkxg jlq6XtpvolvwKfJpeg44hus5k11RPDCCBhAwggP4oAMCAQICEE2ULBDUO+CUCcWBLTorBk8wDQYJ KoZIhvcNAQEMBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQH EwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYDVQQDEyVV U0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE4MTEwMjAwMDAwMFoXDTMw MTIzMTIzNTk1OVowgZYxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIx EDAOBgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2Vj dGlnbyBSU0EgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDKPO2UCkH/3vlGuejWO+bakr8rEE6qGryCvb4mHCkq KtLNnFCBP22ULvOXqGfV9eNKjkypdR8i0yW2sxpepwRIm4rx20rno0JKuriIMpoqr03E5cWapdfb M3wccaNDZvZe/S/Uvk2TUxA8oDX3F5ZBykYQYVRR3SQ36gejH4v1pXWuN82IKPdsmTqQlo49ps+L bnTeef8hNfl7xZ8+cbDhW5nv0qGPVgGt/biTkR7WwtMewu2mIr06MbiJBEF2rpn9OVXH+EYB7PmH fpsEkzGp0cul3AhSROpPyx7d53Q97ANyH/yQc+jl9mXm7UHR5ymr+wM3/mwIbnYOz5BTk7kTAgMB AAGjggFkMIIBYDAfBgNVHSMEGDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4EFgQUCcDy /AvalNtf/ivfqJlCz8ngrQAwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBEGA1UdIAQKMAgwBgYEVR0gADBQBgNVHR8ESTBH MEWgQ6BBhj9odHRwOi8vY3JsLnVzZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQ2VydGlmaWNhdGlv bkF1dGhvcml0eS5jcmwwdgYIKwYBBQUHAQEEajBoMD8GCCsGAQUFBzAChjNodHRwOi8vY3J0LnVz ZXJ0cnVzdC5jb20vVVNFUlRydXN0UlNBQWRkVHJ1c3RDQS5jcnQwJQYIKwYBBQUHMAGGGWh0dHA6 Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEMBQADggIBAEFEdQCrOcIV9d6OlW0ycWiM AN0X13ocEDiQyOOxvRcxkfO244K0oX7GzCGHYaqRbklCszzNWVT4DZU/vYrLaeVEDUbCYg+Ci7vh Nn9dNqscbzN0xKBoOuRVjPPWDechU70geT3pXCxpwi8EXwl+oiz7xpYfY99JSs3E/piztTSxljHi tcPr5yoWr9lbkFR8KU3+uGTZ11BfKfuSSaRrZFBv133SeY0d2AqvB9Dj2ZDaFZA0OQkkhfAqNgDp VRH99lQV4JSKx0N7/QAEtMj6OF5dRXV6hhXuU3A0Eql4d0247oBpxvnfcmV95QfG8HP059hZSJe7 T2wwC+IzXVDQO4xnnvrQJ07ZWemxc/grFpgiG+o+pQxapF1bKftysi02Rl6uhdp5wbTeLeYzt2SI 9oKSChwGDQQFixtkNnxuwbdrTwvASwvViDPdIGzIQJrTBqriE5/9nzkXbDZmld8/7DyriJ/A73RI ZllX4dH8mHqsRpU8NEX8IQZWpHWGK5A5nVgvl7MxNfRlIvCvKZQTSnCL8oNqJgHXm6zCB4gBwDon M8V/2kuQAUVazVA3I376eIWGwzjuqh3H88v7mNHzubLHm5h0ERCSQNz6UoHVZy3q5xeqbYSaxpDQ z3lCNObL6sNaOQNh3DcyzqZJYTcGfuLlmC3AIteAAh7lbybJszYnMYIDxzCCA8MCAQEwgawwgZYx CzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZv cmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50 IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0ECEQCHdyN3B9tVLj3G2kwpB3m2MA0G CWCGSAFlAwQCAQUAoIIB6zAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTA3MjIxNjI1NTdaMC8GCSqGSIb3DQEJBDEiBCDlmpwF8NP0HKqMj0a+yK1V1JwaPzbDXaVy K3rE5CcwWTCBvQYJKwYBBAGCNxAEMYGvMIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0 ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJl IEVtYWlsIENBAhEAh3cjdwfbVS49xtpMKQd5tjCBvwYLKoZIhvcNAQkQAgsxga+ggawwgZYxCzAJ BgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQx GDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE+MDwGA1UEAxM1U2VjdGlnbyBSU0EgQ2xpZW50IEF1 dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0ECEQCHdyN3B9tVLj3G2kwpB3m2MA0GCSqG SIb3DQEBAQUABIIBAJPzfCLShnck35vMoHoIUG60eL9y0a9Bqjq63gBbdV4b/LufIaiqq+lvWWTa 3fkH6FH3ZRTSQGCp6ymoeqrwwvgosGF2xd+IrmCdecL2LuTOrTdG7uD3/CDFgif/jrIflHTy/ZUj jU2fJptUDwc1qUOI81p0hJIAmGQgk7N1gh8TIW/aWnfzgM2z8ef3XwPO/rpz2FuxEX/EfI33aWqf MGNrkNb+PUkgtZ25XQKU6Pnz37YyidLMF9hD7D0R/5Cot3x+E2o+nM8JKXVpYxrqV2NeAgOm2dh8 aCjDWmXfTa7Ik6Ms7jEXl0F2v417vh9B7RBynsr18KQjelNmhF1bGAIAAAAAAAA= --Apple-Mail=_7B555A2A-9E3D-4DBF-A3AB-F2049B13F058--