Re: [OAUTH-WG] OAuth & Enteprise federation ... 5 years from now

Lewis Adam-CAL022 <> Thu, 27 March 2014 17:47 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 2E5B61A0720 for <>; Thu, 27 Mar 2014 10:47:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.348
X-Spam-Status: No, score=-1.348 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, UNRESOLVED_TEMPLATE=1.252] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id wGTY_raecbVW for <>; Thu, 27 Mar 2014 10:47:02 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 81BA21A0709 for <>; Thu, 27 Mar 2014 10:46:58 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server id; Thu, 27 Mar 2014 17:46:56 +0000
Received: from mail37-am1 (localhost []) by (Postfix) with ESMTP id 123A1404FF for <>; Thu, 27 Mar 2014 17:46:56 +0000 (UTC)
X-Forefront-Antispam-Report: CIP:; KIP:(null); UIP:(null); IPV:NLI;; RD:none; EFVD:NLI
X-SpamScore: -20
X-BigFish: VPS-20(zz98dI9371Ic85fhzz1f42h2148h208ch1ee6h1de0h1fdah2073h2146h1202h1e76h2189h1d1ah1d2ah21bch1fc6hzz1d7338h1de098h1033IL17326ah8275bh8275dh18c673h1c8fb4h1de097h186068hz2fh109h2a8h683h839hd24hf0ah1288h12a5h12bdh137ah1441h1504h1537h153bh162dh1631h1758h18e1h1946h19b5h19ceh1ad9h1b0ah1b2fh1bceh224fh1fb3h1d07h1d0ch1d2eh1d3fh1de9h1dfeh1dffh1fe8h1ff5h20f0h2216h22d0h2336h2461h2487h24d7h2516h2545h255eh25cch25f6h2605h268bh9a9j1155h)
Received-SPF: pass (mail37-am1: domain of designates as permitted sender) client-ip=;; ; ;
X-Forefront-Antispam-Report-Untrusted: CIP:; KIP:(null); UIP:(null); (null);; R:internal; EFV:INT
Received: from mail37-am1 (localhost.localdomain []) by mail37-am1 (MessageSwitch) id 1395942413430574_3212; Thu, 27 Mar 2014 17:46:53 +0000 (UTC)
Received: from (unknown []) by (Postfix) with ESMTP id 5B378100088 for <>; Thu, 27 Mar 2014 17:46:53 +0000 (UTC)
Received: from ( by ( with Microsoft SMTP Server (TLS) id; Thu, 27 Mar 2014 17:46:51 +0000
Received: from ( []) by (8.14.3/8.14.3) with ESMTP id s2RHkoSr011356 for <>; Thu, 27 Mar 2014 12:46:50 -0500 (CDT)
Received: from ( []) by (8.14.3/8.14.3) with ESMTP id s2RHkncV011353 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for <>; Thu, 27 Mar 2014 12:46:50 -0500 (CDT)
Received: from ( by ( with Microsoft SMTP Server id; Thu, 27 Mar 2014 17:46:49 +0000
Received: from mail19-tx2 (localhost []) by (Postfix) with ESMTP id 80B2F140227 for <>; Thu, 27 Mar 2014 17:46:49 +0000 (UTC)
X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009001)(428001)(24454002)(377454003)(199002)(189002)(19580405001)(83322001)(81816001)(4396001)(49866001)(19580395003)(77982001)(97186001)(79102001)(47976001)(81686001)(50986001)(69226001)(80976001)(47736001)(95666003)(81342001)(81542001)(97336001)(74502001)(47446002)(59766001)(18717965001)(76576001)(76796001)(33646001)(51856001)(76786001)(53806001)(95416001)(93136001)(74876001)(2656002)(63696002)(74316001)(65816001)(74662001)(54316002)(31966008)(20776003)(76482001)(80022001)(93516002)(19300405004)(66066001)(85852003)(56776001)(83072002)(74706001)(74366001)(87266001)(92566001)(94946001)(86362001)(94316002)(46102001)(54356001)(15975445006)(98676001)(56816005)(15202345003)(19609705001)(87936001)(85306002)(16236675002)(90146001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR04MB734;; FPR:ACFC5139.972658C3.B1F371BB.4AE4B871.204EE; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
Received: from mail19-tx2 (localhost.localdomain []) by mail19-tx2 (MessageSwitch) id 1395942407822524_20690; Thu, 27 Mar 2014 17:46:47 +0000 (UTC)
Received: from (unknown []) by (Postfix) with ESMTP id B31F01C009C; Thu, 27 Mar 2014 17:46:47 +0000 (UTC)
Received: from ( by ( with Microsoft SMTP Server (TLS) id; Thu, 27 Mar 2014 17:46:46 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 14.16.423.0; Thu, 27 Mar 2014 17:46:32 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.898.11; Thu, 27 Mar 2014 17:46:31 +0000
Received: from ([]) by ([]) with mapi id 15.00.0898.005; Thu, 27 Mar 2014 17:46:31 +0000
From: Lewis Adam-CAL022 <>
To: John Bradley <>
Thread-Topic: [OAUTH-WG] OAuth & Enteprise federation ... 5 years from now
Thread-Index: Ac9JvWeAW+r7N2YsS96k1esZSJ97mAACGN8AAAeYdsA=
Date: Thu, 27 Mar 2014 17:46:29 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
x-forefront-prvs: 01630974C0
Content-Type: multipart/alternative; boundary="_000_4fa46e94eca54ce0940162f8ef4101ddDM2PR04MB735namprd04pro_"
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Cc: "" <>
Subject: Re: [OAUTH-WG] OAuth & Enteprise federation ... 5 years from now
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 27 Mar 2014 17:47:08 -0000

Hi John,

With respect to Google Play handing out id_tokens, are any there any known instances of that being used?  Either to kick of an assertion flow with another (non-Google) AS, or to present directly to a non-Google RS?


From: John Bradley []
Sent: Thursday, March 27, 2014 9:07 AM
To: Lewis Adam-CAL022
Subject: Re: [OAUTH-WG] OAuth & Enteprise federation ... 5 years from now

Hi Adam,

3 is the most common today.  In the Salesforce case it has the additional benefit that when Domain 1 is federating to SalesForce via OpenID Connect it can provide access tokens for it's API to sales force scoped for that user for use in the SalesForce custom logic.

1 and 2 are similar and likely it is more of a deployment choice between them.
We do see examples of this currently with the Android play store providing third-party id_tokens/JWT assertions to OAuth clients.

The reason for doing 1 or 2 vs 3 probably comes down to connivence and security if  there is an agent for the user's  IdP on the device that can act as a confidential client to the IdP for security and provide a more consistent UI for the user.   That is what we are working on in the NAPPS WG at OIDF.

We have examples of 1/2 now, the problem is that they are not as universally applicable as 3 but hopefully with standardization for developers we will se more in the next year or so.

John B.

On Mar 27, 2014, at 10:06 AM, Lewis Adam-CAL022 <<>> wrote:

I am curious it ping the thoughts of others on the list of how OAuth is going to continue to mature, especially with respect to enterprise federation scenarios.  This is something that I spend a whole lot of time thinking about.  Specifically, consider the following use case:

An end user in domain 1 downloads a native application to access an API exposed by domain 2, to access a protected resource in domain 2, under the administrative control of the domain 2 enterprise.

There are in my mind three basic means by which OAuth can federate, which I know I have discussed with some of you in the past:

1.       First option ... End user in domain 1 requests a JWT-structured access_token from the OAuth provider in domain 1, and sends it in the HTTP header directly to the RS in domain 2.   The JWT access_token looks a whole lot like a OIDC id_token (maybe it even is one?).  The RS in domain 2 is able to make attributed-based access control decisions based on the contents of the JWT.  This is architecturally the simplest approach, but enterprises aren't exactly setting up OAuth providers these days for the intent of accessing protected resources in foreign domains.  Anybody think this might be the case 5 years from now?

2.       Second option ... similar to the first, but the JWT-structured access_token from domain 1 is sent to the OAuth provider in domain 2, ala the JWT assertion profile.  Domain 1 access token is exchanged for a domain 2 access token, and the native client uses the domain 2 access token to send to the protected resource in domain 2.  I like this slightly more than the first option, because the resources servers in domain 2 only need to understand the token format of their own AS.  But it still suffers from the same basic challenge of option 1, that enterprises don't' setup OAuth providers today for the purpose of federating, the way that setup SAML providers for WebSSO.

3.       Third option.  Native client contacts the OAuth provider in domain 2 directly.  The authorization endpoint is federation enabled (NASCAR or other) and the user in domain 1 selects their home IdP (SAML or OIDC) and does WebSSO to federated into the domain 2 OAuth provider.  I believe this is the model that Salesforce supports today, and it the most tactical, since enterprise that want to federate today run out and buy a SAML provider.

So option 3 is the most obvious approach today.  Does anybody foresee enterprises setting up an STS in the future to federate to foreign RS's (the way they setup SAML providers today)?  Anybody think we will see options 1 or 2 in the future?

OAuth mailing list<>