[OAUTH-WG] Token exchange use cases

George Fletcher <gffletch@aol.com> Thu, 07 December 2017 17:00 UTC

Return-Path: <gffletch@aol.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 3EACF1294A3 for <oauth@ietfa.amsl.com>; Thu, 7 Dec 2017 09:00:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.699
X-Spam-Status: No, score=-4.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mx.aol.com
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id ZviD8pwXEXHz for <oauth@ietfa.amsl.com>; Thu, 7 Dec 2017 09:00:13 -0800 (PST)
Received: from omr-a018e.mx.aol.com (omr-a018e.mx.aol.com []) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 887B41294A8 for <oauth@ietf.org>; Thu, 7 Dec 2017 09:00:13 -0800 (PST)
Received: from mtaout-mbc01.mx.aol.com (mtaout-mbc01.mx.aol.com []) by omr-a018e.mx.aol.com (Outbound Mail Relay) with ESMTP id D0F853800055; Thu, 7 Dec 2017 12:00:12 -0500 (EST)
Received: from [] (unknown []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mtaout-mbc01.mx.aol.com (MUA/Third Party Client Interface) with ESMTPSA id E2F8E380000A0; Thu, 7 Dec 2017 12:00:11 -0500 (EST)
To: "oauth@ietf.org" <oauth@ietf.org>
From: George Fletcher <gffletch@aol.com>
Organization: AOL LLC
Message-ID: <e80abfc8-be9f-e435-0251-9b8a043b145b@aol.com>
Date: Thu, 7 Dec 2017 12:00:10 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.5.0
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------5E82469B1E037FDBA22396F1"
Content-Language: en-US
x-aol-global-disposition: G
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mx.aol.com; s=20150623; t=1512666012; bh=NSl+piFxqTbKJhjHokq4TUdSTJj6IbAeNX0Xv+116YU=; h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type; b=w81UqYTC3gar2lIPK2AQdJuPr2EPHnCILQTs+3oG6SXNi+J7nLbecvTo3QpNSxw0o xkbIv/tMEC3gf2iQ6akc8h4vzvehbN2TsPBDEedmULu1MzvtZOv+FVQY2x1QwGDgup kxXMzU3Hj3bn/odafY12h8ZQg2QMVNW9U0wkL1zQ=
x-aol-sid: 3039ac1add8d5a29739b12e7
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/5Z8WNdKxHS4rZIg6mus7MftVSoc>
Subject: [OAUTH-WG] Token exchange use cases
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Dec 2017 17:00:15 -0000

I have a use case for which I'd like to leverage the token exchange spec...

1. As part of an identity migration effort, I'd like to exchange a 
refresh_token issued by one AS for a refresh_token, access_token and 
potentially id_token issued by a second AS.

For this use case I have two questions...

    -- does the spec allow me to extend the response to include an 
additional "claim" in the response?
        refresh_token and access_token are already defined, but id_token 
is not

    -- what would I use as the desired "requested_token_type"?
        should it be a "virtual" token type that then represents the 
tokens to be returned in the response?
        It looks like I could also leave the "requested_token_type" 
blank and just let the AS do what it wants. Is that the best option?