Re: [OAUTH-WG] JWT Destination Claim

Brian Campbell <bcampbell@pingidentity.com> Thu, 26 March 2015 00:34 UTC

MIME-Version: 1.0
In-Reply-To: <BN3PR0301MB123419B3AE4F837B3E249451A60B0@BN3PR0301MB1234.namprd03.prod.outlook.com>
References: <CA+k3eCTYjMeY7=xcWjOTfs0bGtZaMpCgynmS3hP9BrKmUHZXSg@mail.gmail.com> <BY2PR03MB442687E4C3862894786536FF50B0@BY2PR03MB442.namprd03.prod.outlook.com> <CA+k3eCSwdfO6t5pB1TS9U48SvcT2DtJJkntWOFv0j7b0oT+sWg@mail.gmail.com> <BN3PR0301MB123419B3AE4F837B3E249451A60B0@BN3PR0301MB1234.namprd03.prod.outlook.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Wed, 25 Mar 2015 19:33:31 -0500
Message-ID: <CA+k3eCRc75_HohDTf8zGrnsox9T5bVKrWVAL5Wukhy8+z=_mkQ@mail.gmail.com>
To: Anthony Nadalin <tonynad@microsoft.com>
Content-Type: multipart/alternative; boundary="20cf303345f315b7100512262c7c"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/7RIqP23ltg-Q3PwOeCp1EmoDb6Q>
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] JWT Destination Claim
Precedence: list

Tony, thanks as always for your thoughtful, well reasoned, and helpful
comments.

I'm well aware of the potential for confusion, which is why I endeavored to
address the differences between aud and dst with text in the draft.

I do appreciate your permission to use it ourselves and I'll be sure to let
the engineers that have already deployed it know that they have your
blessing.

As I said on Monday, it struck me as something that would have value well
beyond our own usage and that was why I wanted to start a conversation
about standardization. You're stance on that has been made pretty clear,
thanks.



On Wed, Mar 25, 2015 at 6:57 PM, Anthony Nadalin <tonynad@microsoft.com>
wrote:

>  There some folks out there that are using AUD to mean DST. Adding DST is
> confusing, if you want to use it that's fine but don't see a need to
> standardize every claim that someone comes up with
>
> Sent from my Windows Phone
>  ------------------------------
> From: Brian Campbell <bcampbell@pingidentity.com>
> Sent: ‎3/‎25/‎2015 2:19 PM
> To: Mike Jones <Michael.Jones@microsoft.com>
> Cc: oauth <oauth@ietf.org>
> Subject: Re: [OAUTH-WG] JWT Destination Claim
>
>  FWIW, I did have that as an open issue in the draft:
> http://tools.ietf.org/html/draft-campbell-oauth-dst4jwt-00#appendix-A
>
> Though the way I worded it probably shows my bias.
>
> On Wed, Mar 25, 2015 at 2:16 PM, Mike Jones <Michael.Jones@microsoft.com>
> wrote:
>
>>  Thanks for posting this, Brian.  To get it down on the list, I’ll
>> repeat my comment made in person that just as “aud” used to be
>> single-valued and ended up being multi-valued, I suspect some applications
>> would require the same thing of “dst” – at least when “aud” and “dst” are
>> different.  And even if “dst” becomes multi-valued, it’s OK for particular
>> applications to require that it be single-valued in their usage.
>>
>>
>>
>>                                                             -- Mike
>>
>>
>>
>> *From:* OAuth [mailto:oauth-bounces@ietf.org] *On Behalf Of *Brian
>> Campbell
>> *Sent:* Wednesday, March 25, 2015 2:08 PM
>> *To:* oauth
>> *Subject:* [OAUTH-WG] JWT Destination Claim
>>
>>
>>
>> Here are the slides that I rushed though at the end of the Dallas meeting:
>>
>> https://www.ietf.org/proceedings/92/slides/slides-92-oauth-1.pdf
>>
>>
>>
>> And the -00 draft:
>> http://tools.ietf.org/html/draft-campbell-oauth-dst4jwt-00
>>
>> In an informal discussion earlier this week John B. suggested that some
>> additional thinking and/or clarification is needed with regard to what
>> parts of the URI to include and check. Particularly with respect to query
>> and fragment. And he's probably right.
>>
>
>

[OAUTH-WG] JWT Destination Claim Brian Campbell
Re: [OAUTH-WG] JWT Destination Claim Mike Jones
Re: [OAUTH-WG] JWT Destination Claim Brian Campbell
Re: [OAUTH-WG] JWT Destination Claim Anthony Nadalin
Re: [OAUTH-WG] JWT Destination Claim Brian Campbell