IETF Logo Mail Archive

Re: [OAUTH-WG] DPoP and MTLS - friends or foes?

Brian Campbell <bcampbell@pingidentity.com> Fri, 12 November 2021 22:00 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB80D3A1280 for <oauth@ietfa.amsl.com>; Fri, 12 Nov 2021 14:00:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=pingidentity.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fg1r-Um2eaov for <oauth@ietfa.amsl.com>; Fri, 12 Nov 2021 14:00:15 -0800 (PST)
Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E85DA3A127A for <oauth@ietf.org>; Fri, 12 Nov 2021 14:00:14 -0800 (PST)
Received: by mail-lj1-x230.google.com with SMTP id t11so21154779ljh.6 for <oauth@ietf.org>; Fri, 12 Nov 2021 14:00:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0gR3GQDNSV8xGPxja9wkclRz2DphguVE2kz87EC2XPI=; b=EjB9qdtQlF+LQVZf7UB+p+zRxgmn/ICpMuFWrg/f2SMHzX5Vfc4olPXshviyE2Agd5 W+XPCB+OIC3ojQFZhFDs9BfZPsTWiEMFKRUukVlx7QEhs9LEJukRZhqcqMC1RW3iBzKX MY0Aexg/0GyUdb7ktFARD5NakVXfCOxsPLgUTaSgAq4sfGuUBLr67JOSe/mbr4FSI9IZ ynUrX46+JhFM13kTHRW+hw/e9dCDMNSiQCJA5qmDSbSBc5r6reSTZNjkq6YL0Vl4P8e5 oZCzmk4jDPopKc3r68bgf+M7eqHDeJtV7rkZSCO5a44AH9fJoMrHzwBq0bzv5RPi0ye3 WpyA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0gR3GQDNSV8xGPxja9wkclRz2DphguVE2kz87EC2XPI=; b=PccJVymRZEHYz+cOzme9JzlHMr1MRJ2ia9xRybsyVwnzF1hp2Z+eAWph389lEJAJkS Da3aHjxrfdPbQRvFVTfmk35+x3SEwH0yyVjJa+xv5th0D8OYk9rrHcE4aO8CrD0O42ZY dlqJTEgdwerhKi22Z62f2uHTCTOe7nbDmMnceil00dpX37OZlp7f0F7uXDhuV8gpmL1c MDYPCp7Q16pbn9r2hOoPPP7zKyosseB/4H/Sx+v/9Gf8am/R1gj7AjAnN5uvBpKe8sPJ +Mfl1ER+jGKM3d+w9vcRAhE8wyNab5KTdoMyvrP+Z0wREKpPtkovPMkGIb//c8ek6UTs WFIQ==
X-Gm-Message-State: AOAM531F7U3fpq2rj7k+u6RAE7mwHAB8jDmhj9C63d3QaL7QHmQxDCSf psRUnMmgph04JcZ6iSg0F5VddAXwdhK4bfsgY+rBbUBzrNzLZ7tA0561KxCWqFyq5kQ0c9qttaT ZnUNQiVTmRlOJAJUfUlM=
X-Google-Smtp-Source: ABdhPJyZV2UJqlsgmCQReMi1Se8PrtRHV9j0C8DLutEMuHtDLE2SAZL9ygFFDIs8dENaoIWRfkE+yTYmdV/xGV6/6no=
X-Received: by 2002:a2e:9349:: with SMTP id m9mr19046484ljh.178.1636754412234; Fri, 12 Nov 2021 14:00:12 -0800 (PST)
MIME-Version: 1.0
References: <CAOtx8Dnq31Z+CRP+e3knnekev2q8on1dis=CBz+a82yhf27iZg@mail.gmail.com>
In-Reply-To: <CAOtx8Dnq31Z+CRP+e3knnekev2q8on1dis=CBz+a82yhf27iZg@mail.gmail.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 12 Nov 2021 14:59:46 -0700
Message-ID: <CA+k3eCSwXj2D-wJ3Srzn4yQkcUrdh3Zn4qKK5TJmpWRc6z=Kfg@mail.gmail.com>
To: Dmitry Telegin <dmitryt=40backbase.com@dmarc.ietf.org>
Cc: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000539ff705d09e9551"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/EEidUHFgcaUKMxYpP9xK-Ejvm0o>
Subject: Re: [OAUTH-WG] DPoP and MTLS - friends or foes?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Nov 2021 22:00:20 -0000

I think Neil commented once somewhere about maybe seeing value in both at
the same time. He's smarter than me so I don't like to contradict him. But
I've always thought of them as mutually exclusive. And
practically/pragmatically I think it really is one or the other.

On Fri, Nov 12, 2021 at 9:39 AM Dmitry Telegin <dmitryt=
40backbase.com@dmarc.ietf.org> wrote:

> As an implementer of one binding mechanism (DPoP) for the AS (Keycloak)
> that already features another (MTLS), I'm running into the question whether
> we should allow those two to be used simultaneously (which could be of
> course extrapolated to other hypothetical mechanisms). By "simultaneously"
> I mean binding a single token using both methods given that the material
> for both has been provided with the request.
>
> I guess currently mutual exclusivity is implied. Though in theory the
> "cnf" section of the AT could contain both "jkt" and "x5t#S256", the
> mechanisms are using different values for "token_type" and authentication
> scheme ("DPoP" for DPoP, "Bearer" for MTLS, though the latter might change
> to "MTLS" in the future) and we define no mechanism to combine them (could
> be "Bearer+DPoP" or "DPoP+MTLS" for example, which would be valid as per
> RFCs 7230 and 7235).
>
> I apologize if the question has been asked before; didn't find anything
> relevant in the ML. The implementer of MTLS for Keycloak also voted for
> mutually exclusive behavior.
>
> - Dmitry
> Backbase / Keycloak
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

v2.23.0 | Report a Bug | By Email