Re: [OAUTH-WG] why are we signing?

[Dick Hardt <[e-mail]>]

On 2009-12-02, at 9:57 AM, Mike Malone wrote:
> I'm far from an expert on TLS/PKI, but here's a thought (and I'm
> pretty sure this has come up before)... If TLS is simpler than
> signatures then why not just use PKI for everything. A lot of the
> problems that have come up with OAuth are solved by PKI - client certs
> replace tokens, you can delegate authority by creating
> sub-certificates, the consumer provisioning problem is largely solved,
> etc.
> 
> It seems like WRAP is using bits of PKI to solve half of the problem
> and then re-inventing other bits of PKI for the other half. If TLS/PKI
> is the solution, why not go whole hog?


I'm confused by your PKI references to WRAP.

The token in WRAP is not just about identifying the Client, it also enables authorization.

In the implementations we (Microsoft) have done, the token contains all the claims that the Protected Resource needs to make an access control decision.

I hope to have the OAuth WRAP spec reformated as an I-D late next week.

-- Dick