Re: [OAUTH-WG] Proposed changes to RFC 8705 (oauth-mtls)

[Justin Richer <[e-mail]>]

I disagree with this take. If there are confirmation methods at all, it’s no longer a Bearer token, and pretending that it is doesn’t help anyone. I think combining confirmation methods is interesting, but then you get into a weird space of how to define the combinations, and what to do if one is missing, etc. It opens up a weird space for interop problems. It’s not insurmountable, but I don’t think it’s a trivial as it might look at first.

Plus, the “backwards compatible” argument is what led to the existing RFC using Bearer again. In my view, this actually opens up the possibility of downgrade attacks against the RS, where a lazy RS doesn’t check the binding because it sees “Bearer” and calls it a day. The thing is, turning off that kind of checking is the kind of problem that fails open, like turning off XML signature validation in a SAML environment. The good assertions still pass, and bad assertions happen to also look fine. I don’t think that’s a good space to be in, and re-using “Bearer” like the existing spec does is a problem for that reason.

I would personally love to see a bis of this RFC, but because of inertia around existing deployments, I don’t expect it. I think we’d see a lot of confusion around which version of things to use.

 — Justin

> On Dec 9, 2021, at 8:52 AM, Neil Madden <[e-mail]> wrote:
> 
> I don’t mind about a new error code, although I think it’s of limited value - error codes (rather than descriptive error *messages*) imply that the client may be able to dynamically react to the situation and so something different. But TLS client certs are usually configured statically, so it seems highly unlikely that the client could satisfy this requirement on its own. (Especially without all the other hints that would be missing from the TLS layer, like trusted CAs, supported signature algorithms, etc).
> 
> I am against changing the token type/scheme from Bearer to MTLS.  Mostly because of backwards compatibility issues - we already have customers that have deployed mTLS widely, but also because of conceptual issues I have generally with distinct token_type/schemes:
> 
> 1. Whether an access token is mTLS-bound or a pure bearer token is a property of what the RS enforces, not intrinsic to the token. As far as I am aware, there is no spec anywhere that says what an RS should do if it doesn’t understand a particular confirmation method associated with an access token. So you can easily at present have a situation where an AT is valid at multiple RSes, some of which understand mTLS-binding and some of which do not. Indeed, this is very likely (and desirable) when you are in the process of rolling out stronger security mechanisms on an RS-by-RS basis. (And what if you later decide to move from mTLS to DPoP?) IMO requiring that ATs always have one and only one associated PoP mechanism is a recipe for ossification.
> 
> 2. IMO the “token_type” and Authorization scheme should be primarily about how the AT itself is conveyed to the RS, not about how any associated proof is. Although “Bearer” is not the most appropriate name, I would rather we stuck to that one scheme for conveying ATs regardless of whether they are pure bearer tokens, bound tokens, or whatever. To me, the important part of “Bearer” is that it tells the RS that it can send this token directly to an introspection endpoint (or examine it locally) without first performing some additional processing on it.
> 
> 3. I am generally in favour of allowing ATs to have 0, 1, 2 or any number of confirmation methods associated with them. If we want to make it easier for a client to figure out which ones an RS supports, I’d rather see this as an enhancement to the Bearer WWW-Authentication challenge - e.g. WWW-Authenticate: Bearer … supported_cnf_methods=mtls,dpop
> 
> Anyway, can of worms well and truly opened…
> 
> — Neil
> 
>> On 9 Dec 2021, at 13:23, Dmitry Telegin <dmitryt=[e-mail] <mailto:dmitryt=[e-mail]>> wrote:
>> 
>> There following changes to RFC 8705 have been proposed:
>> - introduce a new error code (e.g. "invalid_mtls_certificate") to be used when the certificate is required by the AS/RS, but the underlying stack has been misconfigured and the client didn't send one;
>> - for bound token use, change Authorization scheme from Bearer to MTLS;
>> - for token response returning a bound token, change token_type from Bearer to MTLS
>> 
>> See discussion: https://mailarchive.ietf.org/arch/msg/oauth/XfeH2q0Rwa2YocsR484xk-8LMqc/ <https://mailarchive.ietf.org/arch/msg/oauth/XfeH2q0Rwa2YocsR484xk-8LMqc/>
>> 
>> Accepting the changes would imply a new RFC and the obsolescence of the current one. Two questions so far:
>> - what's the group's general stance on this, would that be a welcome change?
>> - if so, could we also hear from the implementors if there any other issues / suggested changes.
>> 
>> Dmitry
>> Backbase / Keycloak
>> 
>> _______________________________________________
>> OAuth mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/oauth
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth