Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?

Sergey Beryozkin <sberyozkin@gmail.com> Mon, 18 January 2016 12:44 UTC

Return-Path: <sberyozkin@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06E0D1B366B for <oauth@ietfa.amsl.com>; Mon, 18 Jan 2016 04:44:26 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WVkK3j5jUVAn for <oauth@ietfa.amsl.com>; Mon, 18 Jan 2016 04:44:24 -0800 (PST)
Received: from mail-wm0-x234.google.com (mail-wm0-x234.google.com [IPv6:2a00:1450:400c:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A4961B366A for <oauth@ietf.org>; Mon, 18 Jan 2016 04:44:24 -0800 (PST)
Received: by mail-wm0-x234.google.com with SMTP id r129so49800200wmr.0 for <oauth@ietf.org>; Mon, 18 Jan 2016 04:44:24 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-type:content-transfer-encoding; bh=tDIFUfHK4HzoZkNHPQiGKKkEALCaDQpp8aX+eBx63fM=; b=iWrty4cBhK00Y8LsAp4t/pOQLgYZE4/rfl9pjNKwT51RS4KelfKNCv4NPRQPNZizP9 825g9sFe0xYSfkPfjcoMIaigQnh0uEbhDK7DNvAWOmaS+DiFYiIOzfn05UKUOjMxhnbm iQUaTHp8DdTI+vJIVShu5bJsNjaBUbFbbY+elu9mXJS50dBQkfNKtKfsRnUoxim7XK8y 8oG0JeQ64cThWlQiKCTYlYLu3MRj39dbm7/cjZr95zdCd+TQMqYAjuPmRAZqGjDeTIZI qN3r1n1FmgAy4s8sBVqx5yrzX+ZD7Fiae0ehwJwU9FU50KOwDE/FCrDRFPIRRwsM1h4v 5bWA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=tDIFUfHK4HzoZkNHPQiGKKkEALCaDQpp8aX+eBx63fM=; b=N8xn50pj//0Q/xyHMckqOOHNKR09PGi5+VM3mA6fVAFKHlndnPEf1lU3qNyKsXkgnk OnNk5c/6d1YDB9R/tjYS3NTiNn6TXn+JOyVJaKjM7FVMxqBQSNrRHDO6DKRiMN07QFe1 0KUWrVfbbMDRFp4Uw4hL0I21qw1luY6+jEfEEawJnehqPqBx2QBYM7QeMfMleH8/XUyy 5Ca+w6J58azE+lA9sEpCDYYhOkC5q8u1wMkNJcPx342YFZSPx1B4NlybSsgiN0QLIjMu YOu/0ufvyQi5Gi5/7RGUQ+WOsRnlsZv6ZsJeLLmXla4fUPgFQj/+4WGoNF6O6m1C0nSV GdLQ==
X-Gm-Message-State: ALoCoQmFzS5JJEwmYe0o+zhuwFyCpdbnIsq6uV+sf/YSSCSeKWiKuZ/UzgLRfwVNgQTGxQvlhf05VgFhPfC32fNvtZp4H338gg==
X-Received: by 10.194.86.166 with SMTP id q6mr27094647wjz.69.1453121062778; Mon, 18 Jan 2016 04:44:22 -0800 (PST)
Received: from [10.36.226.98] ([80.169.137.63]) by smtp.googlemail.com with ESMTPSA id q129sm15712848wmd.14.2016.01.18.04.44.21 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 18 Jan 2016 04:44:21 -0800 (PST)
To: Justin Richer <jricher@mit.edu>, oauth@ietf.org
References: <78kleo9cmvytysxs1qv8kep0.1453117674832@email.android.com>
From: Sergey Beryozkin <sberyozkin@gmail.com>
Message-ID: <569CDE25.90908@gmail.com>
Date: Mon, 18 Jan 2016 12:44:21 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1
MIME-Version: 1.0
In-Reply-To: <78kleo9cmvytysxs1qv8kep0.1453117674832@email.android.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/8y0nTFK0yGtqJMcvgP6uz2Af9CY>
Subject: Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 18 Jan 2016 12:44:26 -0000

Hi Justin, thanks for the advice,

Cheers, Sergey
On 18/01/16 11:47, Justin Richer wrote:
> Yes, this is common practice. Give the user the option to remember the
> decision. This is known as "trust on first use", or tofu. Our server,
> MITREid Connect, implements this as do many others.
>
>
>
> -- Justin
>
> / Sent from my phone /
>
>
> -------- Original message --------
> From: Sergey Beryozkin <sberyozkin@gmail.com>;
> Date: 1/18/2016 5:59 AM (GMT-05:00)
> To: oauth@ietf.org
> Subject: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
>
> Hi All
>
> The question relates to the process of showing the authorization
> code/implicit flow consent screen to a user.
>
>
> I'm discussing with my colleagues the possibility of avoiding asking the
> same user whose session has expired and who is re-authenticating with AS
> which scopes should be approved.
>
> For example, suppose the OAuth2 client redirects a user with the
> requested scope 'a'. The user signs in to AS and is shown a consent
> screen asking to approve the 'a' scope. The user approves 'a' and the
> flow continues.
>
> Some time later, when the user's session has expired, the user is
> redirected to AS with the same 'a' scope.
>
> Would it be a good idea, at this point, not to show the user the consent
> screen asking to approve the 'a' scope again ? For example, AS can
> persist the fact that a given user has already approved 'a' for a given
> client earlier, so when the user re-authenticates, AS will use this info
> and will avoid showing the consent screen.
>
> That seems to make sense, but I'm wondering, can there be some security
> implications associated with it, any recommendations/advices will be welcome
>
> Sergey
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth