Re: [OAUTH-WG] draft-ietf-oauth-access-token-jwt-08 question

Please remove my email from the conversation

Em ter., 22 de set. de 2020 às 03:25, Deepak Tiwari <
deepak.tiwari@intigate.in> escreveu:

> Please remove my email from the conversation
>
> On Tue, Sep 22, 2020 at 7:39 AM Logan Widick <logan.widick@gmail.com>
> wrote:
>
>> If I understand "The intent would be to present that information in the
>> same way you would when querying a users/<id>, encoded in claims" correctly,
>> the "roles", "groups", and "entitlements" claims are the same types as the
>> "roles", "groups", and "entitlements" attributes of the User resource
>> schema (pages 24-25 of RFC 7643 for the text; pages 63-67 of RFC 7643 for
>> the schema)? In the schema the attributes are all "complex" (object) type
>> and "multivalued" (array of), although the text for some of these
>> attributes has some "No vocabulary or syntax..." remarks.
>>
>> If that understanding is correct, it might be a good idea to replace the
>> references to "RFC 7643", "Section 4.1.2 of RFC 7643", and "RFC 7643,
>> Section 4.1.2" with something more specific like "the ____ attribute(s) of
>> the User resource schema from Section 4.1.2 of RFC 7643".
>>
>> On Mon, Sep 21, 2020, 15:33 Brian Campbell <bcampbell@pingidentity.com>
>> wrote:
>>
>>> At some point I'm going to be among the lucky few who will be asked to
>>> review the JWT claims registration request. One of the criteria to consider
>>> is "whether the registration description is clear" and Logan's questions
>>> suggest that perhaps the descriptions of these claims are not sufficiently
>>> clear. My assumption was that the claim value for "roles", "groups" and
>>> "entitlements" was going to be an array of strings. Trying to validate my
>>> assumption, I went looking at the text in
>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-2.2.3.1
>>> and
>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2
>>> and followed the reference to
>>> https://tools.ietf.org/html/rfc7643#section-4.1.2 and, honestly, it
>>> wasn't particularly clear to me. Maybe it's my lack of familiarity with the
>>> details of SCIM and the language of RFC 7643. But I think that, for the
>>> sake of clarity and interoperability, some additional specificity is
>>> needed.
>>>
>>> Side note: the "Section 2.2.2.1 of [[this specification]]" references in
>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-09#section-7.2.1
>>> are problmatic (there is no such section in this document) and probably
>>> should be to 2.2.3.1.
>>>
>>> On Fri, Sep 18, 2020 at 6:28 PM Vittorio Bertocci <vittorio.bertocci=
>>> 40auth0.com@dmarc.ietf.org> wrote:
>>>
>>>> Hi Logan,
>>>>
>>>> Thanks for the note.
>>>>
>>>> The intent would be to present that information in the same way you
>>>> would when querying a users/<id>, encoded in claims; hence groups would be
>>>> a list of values representing  what groups the subject belongs to, rather
>>>> than a list of full group definitions (with all the other members belonging
>>>> to them, for example) which would go beyond the intended use of the
>>>> information (supplying authorization information about the subject).
>>>>
>>>> I tried to keep the language high level as I didn’t want to duplicate
>>>> SCIM guidance, or inadvertently narrow down the options products have to
>>>> implement this.  If you think this is too vague, we can try to be more
>>>> specific.
>>>>
>>>>
>>>>
>>>> *From: *OAuth <oauth-bounces@ietf.org> on behalf of Logan Widick <
>>>> logan.widick@gmail.com>
>>>> *Date: *Wednesday, September 16, 2020 at 14:21
>>>> *To: *"oauth@ietf.org" <oauth@ietf.org>
>>>> *Subject: *[OAUTH-WG] draft-ietf-oauth-access-token-jwt-08 question
>>>>
>>>>
>>>>
>>>> I took a look at Section 2.2.3.1: Claims for Authorization Outside of
>>>> Delegation Scenarios (
>>>> https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-08#section-2.2.3.1)
>>>> and I do not understand what exactly the formats of the "roles", "groups",
>>>> and "entitlements" claims will be.
>>>>
>>>> Will the "roles" claim be an array of strings (role names, IDs, or
>>>> links), an array of the "roles" objects from the SCIM User schema (pages
>>>> 66-67 of RFC 7643), or something else?
>>>>
>>>> Will the "groups" claim be an array of strings (group names, IDs, or
>>>> links), an array of the "groups" objects from the SCIM User schema (pages
>>>> 63-64 of RFC 7643), an array of SCIM Group schema objects (pages 69-70 of
>>>> RFC 7643), or something else?
>>>>
>>>> Will the "entitlements" claim be an array of strings (entitlement
>>>> names, IDs, or links), an array of the "entitlements" objects from the SCIM
>>>> User schema (pages 65-66 of RFC 7643), or something else?
>>>>
>>>> Sincerely,
>>>>
>>>> Logan Widick
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>
>>>
>>> *CONFIDENTIALITY NOTICE: This email may contain confidential and
>>> privileged material for the sole use of the intended recipient(s). Any
>>> review, use, distribution or disclosure by others is strictly prohibited.
>>> If you have received this communication in error, please notify the sender
>>> immediately by e-mail and delete the message and any file attachments from
>>> your computer. Thank you.*
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>
>
> --
>
> Regards,
>
> *Deepak Tiwari|* Software Engineer
> Intigate Technologies Pvt. Ltd. | www.intigate.co.in
> Ist Floor, A-119
> Sector-63
> Noida (U.P.) 201301
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
Att.
Guilherme Ap. Sona Kun - Desenvolvimento