Re: [OAUTH-WG] draft-ietf-oauth-access-token-jwt-08 question

Please remove my email from the conversation

On Tue, Sep 22, 2020 at 7:39 AM Logan Widick <logan.widick@gmail.com> wrote:

> If I understand "The intent would be to present that information in the
> same way you would when querying a users/<id>, encoded in claims" correctly,
> the "roles", "groups", and "entitlements" claims are the same types as the
> "roles", "groups", and "entitlements" attributes of the User resource
> schema (pages 24-25 of RFC 7643 for the text; pages 63-67 of RFC 7643 for
> the schema)? In the schema the attributes are all "complex" (object) type
> and "multivalued" (array of), although the text for some of these
> attributes has some "No vocabulary or syntax..." remarks.
>
> If that understanding is correct, it might be a good idea to replace the
> references to "RFC 7643", "Section 4.1.2 of RFC 7643", and "RFC 7643,
> Section 4.1.2" with something more specific like "the ____ attribute(s) of
> the User resource schema from Section 4.1.2 of RFC 7643".
>
> On Mon, Sep 21, 2020, 15:33 Brian Campbell <bcampbell@pingidentity.com>
> wrote:
>
>> At some point I'm going to be among the lucky few who will be asked to
>> review the JWT claims registration request. One of the criteria to consider
>> is "whether the registration description is clear" and Logan's questions
>> suggest that perhaps the descriptions of these claims are not sufficiently
>> clear. My assumption was that the claim value for "roles", "groups" and
>> "entitlements" was going to be an array of strings. Trying to validate my
>> assumption, I went looking at the text in
>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-2.2.3.1
>> and
>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2
>> and followed the reference to
>> https://tools.ietf.org/html/rfc7643#section-4.1.2 and, honestly, it
>> wasn't particularly clear to me. Maybe it's my lack of familiarity with the
>> details of SCIM and the language of RFC 7643. But I think that, for the
>> sake of clarity and interoperability, some additional specificity is
>> needed.
>>
>> Side note: the "Section 2.2.2.1 of [[this specification]]" references in
>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2.1
>> are problmatic (there is no such section in this document) and probably
>> should be to 2.2.3.1.
>>
>> On Fri, Sep 18, 2020 at 6:28 PM Vittorio Bertocci <vittorio.bertocci=
>> 40auth0.com@dmarc.ietf.org> wrote:
>>
>>> Hi Logan,
>>>
>>> Thanks for the note.
>>>
>>> The intent would be to present that information in the same way you
>>> would when querying a users/<id>, encoded in claims; hence groups would be
>>> a list of values representing  what groups the subject belongs to, rather
>>> than a list of full group definitions (with all the other members belonging
>>> to them, for example) which would go beyond the intended use of the
>>> information (supplying authorization information about the subject).
>>>
>>> I tried to keep the language high level as I didn’t want to duplicate
>>> SCIM guidance, or inadvertently narrow down the options products have to
>>> implement this.  If you think this is too vague, we can try to be more
>>> specific.
>>>
>>>
>>>
>>> *From: *OAuth <oauth-bounces@ietf.org> on behalf of Logan Widick <
>>> logan.widick@gmail.com>
>>> *Date: *Wednesday, September 16, 2020 at 14:21
>>> *To: *"oauth@ietf.org" <oauth@ietf.org>
>>> *Subject: *[OAUTH-WG] draft-ietf-oauth-access-token-jwt-08 question
>>>
>>>
>>>
>>> I took a look at Section 2.2.3.1: Claims for Authorization Outside of
>>> Delegation Scenarios (
>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-08#section-2.2.3.1)
>>> and I do not understand what exactly the formats of the "roles", "groups",
>>> and "entitlements" claims will be.
>>>
>>> Will the "roles" claim be an array of strings (role names, IDs, or
>>> links), an array of the "roles" objects from the SCIM User schema (pages
>>> 66-67 of RFC 7643), or something else?
>>>
>>> Will the "groups" claim be an array of strings (group names, IDs, or
>>> links), an array of the "groups" objects from the SCIM User schema (pages
>>> 63-64 of RFC 7643), an array of SCIM Group schema objects (pages 69-70 of
>>> RFC 7643), or something else?
>>>
>>> Will the "entitlements" claim be an array of strings (entitlement names,
>>> IDs, or links), an array of the "entitlements" objects from the SCIM User
>>> schema (pages 65-66 of RFC 7643), or something else?
>>>
>>> Sincerely,
>>>
>>> Logan Widick
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>
>> *CONFIDENTIALITY NOTICE: This email may contain confidential and
>> privileged material for the sole use of the intended recipient(s). Any
>> review, use, distribution or disclosure by others is strictly prohibited.
>> If you have received this communication in error, please notify the sender
>> immediately by e-mail and delete the message and any file attachments from
>> your computer. Thank you.*
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 

Regards,

*Deepak Tiwari|* Software Engineer
Intigate Technologies Pvt. Ltd. | www.intigate.co.in
Ist Floor, A-119
Sector-63
Noida (U.P.) 201301