To: oauth@ietf.org
From: pedram.h@gmx.de
Message-ID: <df0f8268-13a8-90d7-fc40-32e5b7371cc9@gmx.de>
Date: Mon, 14 May 2018 14:46:52 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.7.0
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="------------7501F0E4A4881930DD4FDF5F"
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/BFtR_Sd0EpLUVEYU27vHGgbCRHo>
Subject: [OAUTH-WG] OAUTB for Access Token in Implicit Grant
Precedence: list

This is a multi-part message in MIME format.
--------------7501F0E4A4881930DD4FDF5F
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Dear all,
We are currently modeling part 1 and part 2 of the OpenID Financial API 
in the FKS Web Model and have a few questions regarding the OAuth 2.0 
Token Binding.
In section 3.1. of draft-ietf-oauth-token-binding-06, it is not very 
clear how an Access Token issued from the Authorization Endpoint is 
Token Bound. Is this intended to be the same as an AC issued for a web 
server client? It seems that the user-agent sends both the Provided and 
Referred Token Bindings to the AS, which means that the AS can bind the 
Access Token to the Referred Token Binding, which is the Token Binding 
between the user-agent and the client.
However, the Access Token is not used by the user-agent, which means 
that the client can only send the Token Binding ID used by the 
user-agent (which essentially is the public key) to the Resource Server.
Is this the intended flow of the Token Binding? Because the first 
paragraph of 3.1 says that the "Token Binding ID of the client's TLS 
channel to the protected resource is sent with the authorization request 
as the Referred Token Binding ID", but we assume that the user-agent 
reveals the TB-ID of its own channel to the client.
Best regards,
Pedram Hosseyni

--------------7501F0E4A4881930DD4FDF5F
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div style="font-family: Verdana;font-size: 12.0px;">
      <div>
        <div>Dear all,</div>
        <div> </div>
        <div>We are currently modeling part 1 and part 2 of the OpenID
          Financial API in the FKS Web Model and have a few questions
          regarding the OAuth 2.0 Token Binding.</div>
        <div> </div>
        <div>In section 3.1. of draft-ietf-oauth-token-binding-06, it is
          not very clear how an Access Token issued from the
          Authorization Endpoint is Token Bound. Is this intended to be
          the same as an AC issued for a web server client? It seems
          that the user-agent sends both the Provided and Referred Token
          Bindings to the AS, which means that the AS can bind the
          Access Token to the Referred Token Binding, which is the Token
          Binding between the user-agent and the client.</div>
        <div>However, the Access Token is not used by the user-agent,
          which means that the client can only send the Token Binding ID
          used by the user-agent (which essentially is the public key)
          to the Resource Server.</div>
        <div> </div>
        <div>Is this the intended flow of the Token Binding? Because the
          first paragraph of 3.1 says that the "Token Binding ID of the
          client's TLS channel to the protected resource is sent with
          the authorization request as the Referred Token Binding ID",
          but we assume that the user-agent reveals the TB-ID of its own
          channel to the client.</div>
        <div> </div>
        <div>Best regards,<br>
          Pedram Hosseyni</div>
      </div>
    </div>
  </body>
</html>

--------------7501F0E4A4881930DD4FDF5F--