[OAUTH-WG] Re: Comments on draft-gerber-oauth-deferred-token-response: delegation verifiability during the pending window

[Mohamad Khalil Yossif <[e-mail]>]

> Frederik,
> 
> You understood me correctly and you are right. The construction as I
> wrote it does not work, and it fails on exactly the case DTR exists
> for.
> 
> I wrote that the AS should decline to issue without a fresh artifact
> from the user's authenticator. "Fresh" was the error. If the artifact
> has to be produced at or near decision time, then every legitimate
> deferred request fails whenever the user has walked away - which is
> the normal case, not the edge case. That is a liveness failure dressed
> as a security property, and no amount of arranging around it recovers
> the goal you have.
> 
> I conflated two things that need separating, and only one of them
> survives your objection.
> 
> Per-delegation scoping survives. An artifact signed at request time,
> bound to that specific action's parameters, verified at decision time
> with no user present, addresses what Mitchell raised: the unit of
> authority for a client serving many principals is the individual
> delegation rather than the client. A steered agent cannot obtain one
> for the action it was steered into, and the other tasks it is running
> correctly are unaffected. Nothing here needs the user at decision
> time, and nothing here needs a channel to the AS.
> 
> Withdrawal does not survive. If the artifact is signed up front and
> remains valid through the deferral, the user cannot revoke by
> withholding anything, because there is nothing left for them to
> withhold. Silence-as-cancellation only works if presence is expected,
> and you have just shown that it is not. So your original position
> stands: cancellation by an initiating entity that is not the client
> needs a way to reach the AS, and that belongs in a profile rather than
> in DTR.
> 
> The one thing between the two that I think is real, offered without
> claiming it solves the above: an artifact can carry a validity window
> the user chooses while they are present. It bounds exposure without
> requiring them later - if the AS decides inside the window it issues,
> outside it it does not. That is not withdrawal and I would not present
> it as such. It is the user pre-committing to how long they are willing
> to remain committed, which is a weaker thing but is available without
> any channel.
> 
> I am not proposing a change to the draft on any of this.
> 
> Mohamad Khalil-Yossif