Re: [OAUTH-WG] Lifetime of refresh token

["Nat Sakimura" <[e-mail]>]

Right. I wrote “pseudo-authentication” because it does not qualify as authentication. 

In another word, I am saying “DO NOT DO IT.”

 

-- 

Nat Sakimura < <mailto:[e-mail]> [e-mail]>

Nomura Research Institute, Ltd. 

 

PLEASE READ:

The information contained in this e-mail is confidential and intended for the named recipient(s) only.

If you are not an intended recipient of this e-mail, you are hereby notified that any review, dissemination, distribution or duplication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete your copy from your system.

 

From: OAuth [mailto:[e-mail]] On Behalf Of John Bradley
Sent: Tuesday, August 25, 2015 12:08 AM
To: Donghwan Kim <[e-mail]>
Cc: [e-mail]
Subject: Re: [OAUTH-WG] Lifetime of refresh token

 

I think Nat’s diagram about the problems of doing pseudo authentication with OAuth is being taken out of context.

 

The refresh token dosen’t expire, it is revoked by the user or system.  In some cases refresh tokens are automatically revoked if the users session to the AS ends.  I think AOL typically revokes refresh tokens when sessions terminate.

 

OpenID Connect provides a separate id_token with a independent lifetime from the refresh token.  A client may keep a refresh token for a much longer time than the user has a login session with the AS.

 

Refresh tokens are typically used by confidential clients that are using a client secret in combination with the refresh token for getting a new access token.

 

By design access tokens should be short lived as the AS is expected to have a way of revoking refresh tokens but not access tokens.

A access token that dosen't expire , and can’t be revoked is not a good idea.

 

John B.

 

 

On Aug 24, 2015, at 2:41 AM, Donghwan Kim <[e-mail] <mailto:[e-mail]> > wrote:

 

Hi,

 

According to Figure 2 from http://tools.ietf.org/html/rfc6749#section-1.5, refresh token can be used to refresh an expired access token without requesting resource owner to sign in again (uncomfortable experience). However, if it's true, isn't it that refresh token might be used to request a new access token even years later? and then isn't refresh token the same with access token which never expires?

 

I intended to use refresh token to implement persistent login by sending a refresh request before issued access token expires (expires_in runs out). But if refresh token works even if access token expired already, sending a refresh request on application start up would be enough.

 

So I'm not sure what I'm missing about refresh token as well as how to implement persistent login using it (you can regard authentication here pseudo-authentication illustrated in https://upload.wikimedia.org/wikipedia/commons/3/32/OpenIDvs.Pseudo-AuthenticationusingOAuth.svg). What is the lifetime of refresh token?

 

Thanks,

 

-- Donghwan

_______________________________________________
OAuth mailing list
[e-mail] <mailto:[e-mail]> 
https://www.ietf.org/mailman/listinfo/oauth