[OAUTH-WG] Stephen Farrell's Discuss on draft-ietf-oauth-assertions-17: (with DISCUSS and COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-oauth-assertions-17: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-oauth-assertions/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


Putting one discuss here rather than one on each of the other
docs. We can fix that as appropriate after we chat.  Where are
the MTI signature and mac algs for these specified? If those
can be tracked back via the SAML and jose docs that's fine,
but I'm not sure if they are.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


- general: What prevents/detects conflicts between the oauth
scope parameter and the saml or jwt equivalent?  Are there
other bits of replicated data that could be the basis for a
vulnerability?

(The comment below applies for both saml and jwt so 
putting it here.)

- The no replay protection issue was debated in the
WG wasn't it? (I think I recall it, not sure.) Seems like a
bad plan to me to not require at least implementation of
replay protection in the AS so that it can be turned on. Can
you point me at where that was discussed on the list?