Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?

William Denniss <wdenniss@google.com> Tue, 19 January 2016 03:10 UTC

Return-Path: <wdenniss@google.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C1651A897E for <oauth@ietfa.amsl.com>; Mon, 18 Jan 2016 19:10:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.379
X-Spam-Level:
X-Spam-Status: No, score=-1.379 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b4LChE5Ov2i4 for <oauth@ietfa.amsl.com>; Mon, 18 Jan 2016 19:10:38 -0800 (PST)
Received: from mail-ob0-x22a.google.com (mail-ob0-x22a.google.com [IPv6:2607:f8b0:4003:c01::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 839781A8987 for <oauth@ietf.org>; Mon, 18 Jan 2016 19:10:35 -0800 (PST)
Received: by mail-ob0-x22a.google.com with SMTP id is5so176782179obc.0 for <oauth@ietf.org>; Mon, 18 Jan 2016 19:10:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=BXswcOPKHP7nUrJTVvRBcK61dGANmLgYiupEPhqOfkw=; b=GsZbUkIYzncw70yu7q6lm2M2cJJg1Aaz7TwRgujRiEA6XnM2hiqp6e+Z+BnRXAkwrM S1bGg3g6ZxITQ7PQiNFCjWynmEPB+I/bbLt/eQf/6uWx3FUH4moHMDT1H+Vhb8Eim9XE NTpNHV2rlKl9Mqju5l9g8dHsdT7oy2Ao1/P9niN2gjAUB2PtxPGvsmI2tAtBSCgg1kmu +TjeNG2mOp/eSh4PqxXDOqVAgoOiDVzQzhli+romg8sevE8Jna0E/jEAofwi64td5v1s LtPg9z4RelDl8lD8qhivpffLFVaMtf/tx+Leq5nQrFICCpNdgDYUnTV4K8Eh0gzlh1gi 2pyA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=BXswcOPKHP7nUrJTVvRBcK61dGANmLgYiupEPhqOfkw=; b=hDduQfIP932Dki5C/2uBEImLcG5idshN6bj9ByfUCKwm4DyfNaRcaT90cUjXiJ+IHG /umJJ0HHUakNJ0KXFkiDgn+dqBJFkDMaXILKpsDDTbpDnvm5KEonBluztY1DkapjpmW0 wHEUVGOBJQBvKMRhai2TiFiid3NQ4p6A6iPG6oLq/p3Eb/zlEWtuShdodoCwIOCnA08S jWl9WttK8rhsuug/KIfFyWirCUX+myZOkeyfENgTVhsUXGpMxhKsjB8TgWo45TkCDaJF m8UTWqL65cwgydzm/rHNF0o4p3sI+XCAwZZ2mSIP/+DZS5/ttWlWwAnKsAM+cyMj2Z+W +t5w==
X-Gm-Message-State: ALoCoQlry3cEZIiLfcQEgbqVuqUSsCW2yBTpeKeN632d5tjpOKCP4B9KlTrMSFluzVX+1WskJbXafXYh+i4+VEMTYx551aZvgvLG4Ki8yD3a/G9/kgvRk8g=
X-Received: by 10.60.124.83 with SMTP id mg19mr21367233oeb.14.1453173034851; Mon, 18 Jan 2016 19:10:34 -0800 (PST)
MIME-Version: 1.0
Received: by 10.182.227.39 with HTTP; Mon, 18 Jan 2016 19:10:15 -0800 (PST)
In-Reply-To: <569CDE25.90908@gmail.com>
References: <78kleo9cmvytysxs1qv8kep0.1453117674832@email.android.com> <569CDE25.90908@gmail.com>
From: William Denniss <wdenniss@google.com>
Date: Mon, 18 Jan 2016 19:10:15 -0800
Message-ID: <CAAP42hA_3EmJw7fAXSSfg=KynAMF26x6vgm1HyLX1RAS4OpKfQ@mail.gmail.com>
To: Sergey Beryozkin <sberyozkin@gmail.com>
Content-Type: multipart/alternative; boundary=047d7b5d2fd28a63970529a736a1
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/FI4WAtUnnbbWbn0DYiAZNUvgP9Q>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Jan 2016 03:10:40 -0000

Agree with Justin, this is pretty common. We support it for re-auth as well
as incremental auth (where the user has already approved scope "a" and is
presented with a request for scopes "a b", they will only need to approve
scope "b").  In fact if you don't do this, then incremental auth isn't
really viable.

Regarding security: don't do this for non-confidential clients where you
can't verify the identity of the app by the redirect (e.g. a localhost
redirect to an installed app).

On Mon, Jan 18, 2016 at 4:44 AM, Sergey Beryozkin <sberyozkin@gmail.com>;
wrote:

> Hi Justin, thanks for the advice,
>
> Cheers, Sergey
>
> On 18/01/16 11:47, Justin Richer wrote:
>
>> Yes, this is common practice. Give the user the option to remember the
>> decision. This is known as "trust on first use", or tofu. Our server,
>> MITREid Connect, implements this as do many others.
>>
>>
>>
>> -- Justin
>>
>> / Sent from my phone /
>>
>>
>> -------- Original message --------
>> From: Sergey Beryozkin <sberyozkin@gmail.com>;
>> Date: 1/18/2016 5:59 AM (GMT-05:00)
>> To: oauth@ietf.org
>> Subject: [OAUTH-WG] Can the repeated authorization of scopes be avoided ?
>>
>> Hi All
>>
>> The question relates to the process of showing the authorization
>> code/implicit flow consent screen to a user.
>>
>>
>> I'm discussing with my colleagues the possibility of avoiding asking the
>> same user whose session has expired and who is re-authenticating with AS
>> which scopes should be approved.
>>
>> For example, suppose the OAuth2 client redirects a user with the
>> requested scope 'a'. The user signs in to AS and is shown a consent
>> screen asking to approve the 'a' scope. The user approves 'a' and the
>> flow continues.
>>
>> Some time later, when the user's session has expired, the user is
>> redirected to AS with the same 'a' scope.
>>
>> Would it be a good idea, at this point, not to show the user the consent
>> screen asking to approve the 'a' scope again ? For example, AS can
>> persist the fact that a given user has already approved 'a' for a given
>> client earlier, so when the user re-authenticates, AS will use this info
>> and will avoid showing the consent screen.
>>
>> That seems to make sense, but I'm wondering, can there be some security
>> implications associated with it, any recommendations/advices will be
>> welcome
>>
>> Sergey
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>