Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
Brian Campbell <bcampbell@pingidentity.com> Fri, 11 November 2016 21:54 UTC
Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 697EB12954A for <oauth@ietfa.amsl.com>; Fri, 11 Nov 2016 13:54:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=pingidentity.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xI5rV4evAFEW for <oauth@ietfa.amsl.com>; Fri, 11 Nov 2016 13:54:46 -0800 (PST)
Received: from mail-it0-x22b.google.com (mail-it0-x22b.google.com [IPv6:2607:f8b0:4001:c0b::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BE81129498 for <oauth@ietf.org>; Fri, 11 Nov 2016 13:54:46 -0800 (PST)
Received: by mail-it0-x22b.google.com with SMTP id u205so3527232itc.0 for <oauth@ietf.org>; Fri, 11 Nov 2016 13:54:46 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=qPrFfWUFpb0e1lX7d6RwhdfA3ybOyNGJxnUrc/ahwvc=; b=MwBcDnIsZkidvIj0t5tyRAQEN273GxJNVUziMNsotsxRzDAXAhoatP7arxb5HgT/7K Skn0yOEYWAPIQtA4dCMgi7Df/RSv20gmgkH3gpm+VofPdq1ehLsqDXXgIULWOjJSaWco QwU2wsCfaPSK6j1jaEx83BsQXX8BmtI7Hi/IA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=qPrFfWUFpb0e1lX7d6RwhdfA3ybOyNGJxnUrc/ahwvc=; b=TYOGjjxJQRx0gvnNQSLWZ5ARPs2fb4es4KCMI6rifyncHEmjDEWNWRklc5EEGceK75 ahhVjbahWhHXVTkkGeq5WzN/cN85Gv//xpUVWKmkB55pSv/mF0BYAqDG0ed6TRSRmCDk 1RqAaDNWSiABmC6Mxb/Auzb4+tXQzPCz9Alm6h+7PQPVVEuCV9Wt25W6fO027HNi7xcp uh7xFistQtXyOHk8MjYInIVPL65kAsJaggBDOD7qaqcS9okZO6xLJ/nq4JBH02qt4km2 oF9jdEZeTusIV/LmoL2Ml+fOGABLt/35jhv8FNn5+wwjbTwJRMaC7/ND+WlkU3+OU700 /b9g==
X-Gm-Message-State: ABUngvekyj0+fL9didflenbdLOb4S/57OyKOafbbP4lCsrp1s6KFMzoDx6o2fuxJwsF9TYtsRHr8sv/oCB7OU0+M
X-Received: by 10.107.13.137 with SMTP id 131mr14062736ion.122.1478901285487; Fri, 11 Nov 2016 13:54:45 -0800 (PST)
MIME-Version: 1.0
Received: by 10.79.156.74 with HTTP; Fri, 11 Nov 2016 13:54:14 -0800 (PST)
In-Reply-To: <CAF2hCbYxMLcXaFLHwzM=XTb9ZoTf2V4cW7vNnWhM3nqdbq+DMg@mail.gmail.com>
References: <147613227959.31428.2920748721017165266.idtracker@ietfa.amsl.com> <9CDE07EB-E5B4-43B2-B3C1-F12569CAB458@ve7jtb.com> <26838e0e-1aee-04ca-4f7e-f6cff8dcfacf@connect2id.com> <CA+k3eCQaWm+O8VMNGGJG41j=dW2vqa4n6QZgKmVM9=d0HxgnCA@mail.gmail.com> <853d5445-72e4-a1fb-b89c-919864f051f6@connect2id.com> <CAF2hCbYn5_qBTmYkeJVCtJ-0=zWdRcFfu+0cHHb4ygo6as_V6w@mail.gmail.com> <CA+k3eCRXss-4_Cxmi41YAcXHh0VKeHogGT=xNkAo1mU6e5WG1w@mail.gmail.com> <CAF2hCbaEi4ntDwbWpTJ4-7_uwunK5WhpsoVLKds87r_s4K7n1w@mail.gmail.com> <CA+k3eCRq=P=0wqBx7O3C--fJYTEsuP1WH+1of53_oWb=bxfssw@mail.gmail.com> <41668b29-ba11-3bab-c77d-6b98bcb60280@mit.edu> <CAF2hCbZBaNWygUQo+nkC-KM=1NY4nYKJTwwioHN3G_FvFUKLqA@mail.gmail.com> <CA+k3eCSXpjzpEZUF8YUeEb4U90idVbGPLc1gzeL59PdaP+5qBg@mail.gmail.com> <CAF2hCbYxMLcXaFLHwzM=XTb9ZoTf2V4cW7vNnWhM3nqdbq+DMg@mail.gmail.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 11 Nov 2016 14:54:14 -0700
Message-ID: <CA+k3eCRKa+DEEffxTYyJr62ipNsVYdCwmYAkJqHYov49odLbfw@mail.gmail.com>
To: Samuel Erdtman <samuel@erdtman.se>
Content-Type: multipart/alternative; boundary="001a113fdfd4c7d96f05410d8944"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/C9wDuW7vmNixvW9VxD0y5dnRSNo>
Cc: Nat Sakimura via Openid-specs-fapi <openid-specs-fapi@lists.openid.net>, OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Nov 2016 21:54:48 -0000
>From my point of view, the cleaner solution is using existing fields for what they are well suited rather than inventing new ones. On Fri, Nov 11, 2016 at 1:21 PM, Samuel Erdtman <samuel@erdtman.se> wrote: > You are right one could absolutely use the jwks or jwks_uri attribute, but > from my point of view that would be a workaround. > I would prefer that x5u, x5c and/or x5t was directly available in the > client registration request not via jwks. This would be a cleaner solution. > > Best Regards > Samuel > > On Fri, 11 Nov 2016 at 19:13, Brian Campbell <bcampbell@pingidentity.com> > wrote: > >> Wouldn't the existing jwks/jwks_uri client metadata parameters suffice? >> Perhaps some guidance in this document about that is warranted. But I don't >> believe anything new is needed for that case. >> >> On Nov 11, 2016 9:41 AM, "Samuel Erdtman" <samuel@erdtman.se> wrote: >> >> Just a quick comment, see inline >> >> On Thu, Nov 3, 2016 at 1:41 PM, Justin Richer <jricher@mit.edu> wrote: >> >> I agree that the client_id is unlikely to be found inside the certificate >> itself. The client_id is issued by the authorization server for the client >> to use at that single AS. The certificate is issued by the CA for the >> client to use on any connection. The AS and CA are not likely to be the >> same system in most deployments. The client will use the same cert across >> multiple connections, possibly multiple AS's, but the same isn't true of >> the client_id. >> >> Additionally, I think we want to allow for a binding of a self-signed >> certificate using dynamic registration, much the way that we already allow >> binding of a client-generated JWK today. >> >> Should this specification then extend the dynamic registration >> specification (https://tools.ietf.org/html/rfc7591) with the certificate >> parameter to actually do the registration or is that another document? >> >> >> I do think that more examples and guidance are warranted, though, to help >> AS developers. >> >> -- Justin >> >> On 11/2/2016 5:03 PM, Brian Campbell wrote: >> >> >> On Sun, Oct 30, 2016 at 9:27 AM, Samuel Erdtman <samuel@erdtman.se> >> wrote: >> >> >> I agree it is written so that the connection to the certificate is >> implicitly required but I think it would be better if it was explicit >> written since the lack of a connection would result in a potential security >> hole. >> >> >> That's fair. I agree it can be made more explicit and that it be good to >> do so. >> >> >> >> When it comes to the client_id I think subject common name or maybe >> subject serial numbers will be the common location, and I think an example >> would be valuable. >> >> >> >> In my experience and the way we built support for mutual TLS OAuth client >> auth the client_id value does not appear in the certificate anywhere. I'm >> not saying it can't happen but don't think it's particularly common. >> >> I can look at adding some examples, if there's some consensus that they'd >> be useful and this document moves forward. >> >> >> >> >> I´m not saying it is a bad Idea just that I would prefer if it was not a >> MUST. >> With very limited addition of code it is just as easy to get the >> certificate attribute for client id as it is to get it from the HTTP >> request data (at least in java). I also think that with the requirement to >> match the incoming certificate in some way one has to read out the >> certificate that was used to establish the connection to do some kind of >> matching. >> >> >> Getting data out of the certificate isn't a concern. I just believe that >> the constancy of having the client id parameter is worth the potential >> small amount duplicate data in some cases. It's just a -00 draft though and >> if the WG wants to proceed with this document, we seek further input and >> work towards some consensus. >> >> >> >> _______________________________________________ >> OAuth mailing listOAuth@ietf.orghttps://www.ietf.org/mailman/listinfo/oauth >> >> >> >>
- [OAUTH-WG] Fwd: New Version Notification for draf… John Bradley
- Re: [OAUTH-WG] [Openid-specs-fapi] Fwd: New Versi… Preibisch, Sascha H
- Re: [OAUTH-WG] Fwd: New Version Notification for … Vladimir Dzhuvinov
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Vladimir Dzhuvinov
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Jim Manico
- Re: [OAUTH-WG] Fwd: New Version Notification for … Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Jim Manico
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Sergey Beryozkin
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… John Bradley
- Re: [OAUTH-WG] New Version Notification for draft… Phil Hunt (IDM)
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Phil Hunt (IDM)
- Re: [OAUTH-WG] New Version Notification for draft… Vladimir Dzhuvinov
- Re: [OAUTH-WG] New Version Notification for draft… Sergey Beryozkin
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico