IETF Logo Mail Archive

[OAUTH-WG] JWT - scope claim missing

Hannes Tschofenig <hannes.tschofenig@gmx.net> Thu, 28 February 2013 10:29 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E763221F8B6D for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 02:29:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.617
X-Spam-Level:
X-Spam-Status: No, score=-101.617 tagged_above=-999 required=5 tests=[AWL=0.363, BAYES_00=-2.599, RCVD_IN_SORBS_WEB=0.619, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RpZ6rGLDEK2k for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 02:29:41 -0800 (PST)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) by ietfa.amsl.com (Postfix) with ESMTP id 447B021F84C9 for <oauth@ietf.org>; Thu, 28 Feb 2013 02:29:41 -0800 (PST)
Received: from mailout-de.gmx.net ([10.1.76.16]) by mrigmx.server.lan (mrigmx001) with ESMTP (Nemesis) id 0M7WX3-1V4Tbf2CRj-00xLi8 for <oauth@ietf.org>; Thu, 28 Feb 2013 11:29:40 +0100
Received: (qmail invoked by alias); 28 Feb 2013 10:29:40 -0000
Received: from unknown (EHLO [10.255.133.93]) [194.251.119.201] by mail.gmx.net (mp016) with SMTP; 28 Feb 2013 11:29:40 +0100
X-Authenticated: #29516787
X-Provags-ID: V01U2FsdGVkX18Oy75qg+UO6539fxxI/Gg8CVugeBBC/axwChRCLB wcjxzHqJZsnxXS
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Thu, 28 Feb 2013 12:29:38 +0200
Message-Id: <0EC2404F-E3C5-4AD1-88B4-E74AA0394DD9@gmx.net>
To: "oauth@ietf.org WG" <oauth@ietf.org>
Mime-Version: 1.0 (Apple Message framework v1085)
X-Mailer: Apple Mail (2.1085)
X-Y-GMX-Trusted: 0
Subject: [OAUTH-WG] JWT - scope claim missing
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 28 Feb 2013 10:29:42 -0000

Hi Mike, 

when I worked on the MAC specification I noticed that the JWT does not have a claim for the scope. I believe that this would be needed to allow the resource server to verify whether the scope the authorization server authorized is indeed what the client is asking for. 

Ciao
Hannes

v2.23.0 | Report a Bug | By Email