IETF Logo Mail Archive

Re: [OAUTH-WG] Benjamin Kaduk's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)

Brian Campbell <bcampbell@pingidentity.com> Mon, 17 August 2020 15:36 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 320E13A1113 for <oauth@ietfa.amsl.com>; Mon, 17 Aug 2020 08:36:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=pingidentity.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W62jquCxx-o6 for <oauth@ietfa.amsl.com>; Mon, 17 Aug 2020 08:36:40 -0700 (PDT)
Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B414F3A10E4 for <oauth@ietf.org>; Mon, 17 Aug 2020 08:36:39 -0700 (PDT)
Received: by mail-lj1-x22f.google.com with SMTP id t23so17984801ljc.3 for <oauth@ietf.org>; Mon, 17 Aug 2020 08:36:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3uyM7wSjHi8V/i/M3H0/M02cd78tW8A/HrFtT7O7fv4=; b=Jw8HdccLgDDnOdjArvPFJYzZ4DNs/zDWvcaP5l6RLga2EUvkD/Uoi1uxu9LYOvW5PV LPaQFWD0oHfQEGQRmMovDmeIY5sczKdkyVnPudhnsqy6rHJ0OJ+t0PhwXm/BoJzU4Oxm wu+szJjIg/LBW1ldancGjt5Nezlx9ASeeXGTomQe3i0vzry0nDnumgF5fkLgcLA6tx3b u5EBd5bOsma72OyEiFisUpY6mdsycK5YiQvvLqqiCc6SOAMaPMaV7b7qn5yy/qK1pZIW zgLPSzsPUU66qDeXwk/PahGL2Iv1G9axyVyUQBgUp8JDj9MzML/XMY6B7ZPbBCQ+zPr5 Q1Bw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3uyM7wSjHi8V/i/M3H0/M02cd78tW8A/HrFtT7O7fv4=; b=Fy4C9v2vZpGiQ4Hd7jI190xgBa7nSsJLj08TRxg+8e658yZ3UaAOnF9nLbp9DhRpjl 27bS/BD0e464DcGCmhxB1VKJ1MVJqICkvIVPWjE//Kii2AflRSftV3TeCijSXZpgmsQ2 olfJ8nDkz+pLFA7QCTZopJPrFbe9z762WuTwC2gO4PAs9E/K6il09huxSuVJiik7n5Vz 5fhemFClr8dtFQq3JvTqcOoOAqnOEEMO6/hvicfKIm7QxUgdSYftrdLhCI4LXa1JmWt3 yAvati42Zfy/W/kl7B6H8lQXP1xxisfrwwh96kGWA4QI/3oTVCt+GyiUZmGi+6oF38hn nMHw==
X-Gm-Message-State: AOAM532yGe+FOoWCLkdwmlXLTWY5Zg//4XCZZ0wu+YhxPUJFmoNqYRYF UtJeiuKur68jaIH7vsRZyK2MwEeWqdT1K1AperzJSSNl1Gaq5RIfSwc3SdRHgKx2mUu83JGo/+g 4Nl3f1XOwww1brxwKVVqcdA==
X-Google-Smtp-Source: ABdhPJwLlgAbghCMPtGCjAcHftxozEPt3Au1T4Jfa8BtmX7LuIcw3W5fo6vIFHRHSdV1E6gUK22Hjvnq8RGxHTyK3Uw=
X-Received: by 2002:a2e:968c:: with SMTP id q12mr8190062lji.345.1597678597667; Mon, 17 Aug 2020 08:36:37 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR00MB06863A1064A05D8029C44788F5431@MN2PR00MB0686.namprd00.prod.outlook.com> <CALAqi_9M40enpWOMO2h5rVdiveOxh6hnA1ZLc9EJJ-H_Fp59+g@mail.gmail.com> <c9620f5f-55f2-9b85-61ad-bac5dc1e9877@connect2id.com>
In-Reply-To: <c9620f5f-55f2-9b85-61ad-bac5dc1e9877@connect2id.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Mon, 17 Aug 2020 09:36:11 -0600
Message-ID: <CA+k3eCT6==rB6ietHKvLiULrsaJfJ9EnLF9ytSLPgfY6ACGUOw@mail.gmail.com>
To: Vladimir Dzhuvinov <vladimir@connect2id.com>
Cc: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000479b6005ad14893e"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/81VNYVAizU9l0RriOB3wY9IU9QY>
Subject: Re: [OAUTH-WG] Benjamin Kaduk's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Aug 2020 15:36:41 -0000

On Sat, Aug 15, 2020 at 3:08 AM Vladimir Dzhuvinov <vladimir@connect2id.com>
wrote:

> Regarding the "sub != client_id" check -- could a simple rejection of all
> JWTs with "sub" present suffice?
>

Prohibiting the use of "sub" in request object JWTs would suffice, yes. I'd
suggested the more narrow/specific prohibition with the aim of a smaller
scoped change. But perhaps it'd be simpler to just say don't use "sub"? I
can't think of any non-erroneous reason sub would be in a request object.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

v2.14.0 | Report a Bug | By Email