IETF Logo Mail Archive

Re: [OAUTH-WG] Implementation Status of "JWT Secured Authorization Request (JAR)"

Dominick Baier <dbaier@leastprivilege.com> Tue, 22 September 2020 05:32 UTC

Return-Path: <dbaier@leastprivilege.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FA4D3A13A8 for <oauth@ietfa.amsl.com>; Mon, 21 Sep 2020 22:32:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=leastprivilege-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TQSxDmHNfAsp for <oauth@ietfa.amsl.com>; Mon, 21 Sep 2020 22:32:36 -0700 (PDT)
Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 142D83A13AB for <oauth@ietf.org>; Mon, 21 Sep 2020 22:32:35 -0700 (PDT)
Received: by mail-io1-xd36.google.com with SMTP id j2so18237881ioj.7 for <oauth@ietf.org>; Mon, 21 Sep 2020 22:32:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leastprivilege-com.20150623.gappssmtp.com; s=20150623; h=from:in-reply-to:references:mime-version:date:message-id:subject:to; bh=bss7A8OUqAMeuN66IqPfpn7gHSfOEqMbC3F0n6RfZEY=; b=Ue1O2+doUx0DGjpl6gKjPdnFBaVJYO3/ESLukZNsNRwt3HmW6LWck0VbopCNKjuYmz lFFO0dVgeAzLEB/FkfM7SZA9Q/LLXOJTML7kOTPCP/rfg1jMh+jXSOEoLG2v9PnKMroo zMUF8BSLerTfH/q9hzD5XC8ReInCbLBViFq9XlwwfvO1AzUbHRwSl1iNB9DRuwavvgmg PgpnlMqIrMa1QT+d5i5uBytsSby2wK3IAWPMETEYMhxacjz4VWYMYgYyJKNxX4D0evig yzadAdjGjL4AfDsT//vpchllxOpFW2IcPTJzY/goAwRO9TqrZm2noZUSfrSHZrSl5JTF Fi3g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:in-reply-to:references:mime-version:date :message-id:subject:to; bh=bss7A8OUqAMeuN66IqPfpn7gHSfOEqMbC3F0n6RfZEY=; b=TUQQQWCR9jCxlFiABoPwrMJ5uGKSZRRmyQjjEIRUXhuMoDr0XP0lCaurWckl2e8GEu eCW37sDhsCLWEc4g70g/TN9HLd1lBUbajL7y7fxTURpEBDATP7hO2WyYkTwsFi6R3c0s KXNREyfCXHUcG2ztmw78OkpWQ92LRnmQaVDS8T6DT3GcSgj++FTyUIlUPEbZgdKy5kDD mjn/xT6ta1e/ZsS3slwgpq3WO/0rsvCO8PrPA8CAz8fpMc73xCRDvH2NJBdCf6d+IQIc 84Xpq+b33D7yQzzF8gU2/9OMjcAXpL2DxNKVtUzI2YNcfN3MeQL0nMhNBp1Mi43ZcPr4 bQ6A==
X-Gm-Message-State: AOAM530xWpgoAHyQKdH2zW28h3uMACAYAh5vpGOKmKGK5ldjAAUSNgey C7tVwqJxEIL2VobMeXsTk3MnIlttSq3FF9ub0S+5O1ut4k3+
X-Google-Smtp-Source: ABdhPJyd1PUwcSrV2+KMyeXDa4lxwiJfAPNZW6TwVoMhwebzAFZSYVSL5g3qrcqAWc96AOhQpTVTFuLl2dNBxK/eYiU=
X-Received: by 2002:a05:6602:2f07:: with SMTP id q7mr2217875iow.191.1600752755088; Mon, 21 Sep 2020 22:32:35 -0700 (PDT)
Received: from 1058052472880 named unknown by gmailapi.google.com with HTTPREST; Tue, 22 Sep 2020 01:32:34 -0400
From: Dominick Baier <dbaier@leastprivilege.com>
In-Reply-To: <AM0PR08MB3716CAFF95F9A68853CBEE67FA3A0@AM0PR08MB3716.eurprd08.prod.outlook.com>
References: <AM0PR08MB3716CAFF95F9A68853CBEE67FA3A0@AM0PR08MB3716.eurprd08.prod.outlook.com>
MIME-Version: 1.0
Date: Tue, 22 Sep 2020 01:32:34 -0400
Message-ID: <CAO7Ng+uRsyPY2V0G3aZ01MdnvCfZR1AS4gC2wzkn4Jwn9iBQ6Q@mail.gmail.com>
To: Hannes Tschofenig <hannes.tschofenig@arm.com>, "oauth@ietf.org" <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000057342f05afe04bac"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Fd-0uJhKd_2xKuyD5mUIChoYycg>
Subject: Re: [OAUTH-WG] Implementation Status of "JWT Secured Authorization Request (JAR)"
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Sep 2020 05:32:39 -0000

Also IdentityServer implements JAR

https://github.com/IdentityServer

———
Dominick Baier

On 21. September 2020 at 21:22:17, Hannes Tschofenig (
hannes.tschofenig@arm.com) wrote:

Hi all



Because some procedural issues I have to update the shepherd writeup of the
JAR document and I wanted to verify whether the implementations listed in
https://github.com/hannestschofenig/tschofenig-ids/blob/master/shepherd-writeups/Writeup_OAuth_JAR.txt
(copied below) are still inline with the latest version of
https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-30 (given the changes
the document has gone through*).



----- List of implementations -----



As part of the OpenID Foundation certification program the following



implementations of OpenID Connect Core indicate support for this



functionality:



* CZ.NIC mojeID,



* Thierry Habart's SimpleIdentitySever v.2.0.0,



* Roland Hedberg's pyoidc 0.7.7,



* Peercraft ApS's Peercarft,



* MIT's MITREidConnect,



* Gluue Server 2.3,



* Filip Skokan's node-oidc pre supports.





Authlete (https://www.authlete.com/), a commerical, closed source



server implementation, has also implemented this specification and



is offering it.





There is an open source implementation from NRI in PHP and Scala.



NRI's Open Source PHP: https://bitbucket.org/PEOFIAMP/phpoidc



-----



Ciao

Hannes



PS: List of changes from the current draft to the one when I wrote my
shepherd writeup:

http://tools.ietf.org//rfcdiff?url1=https://tools.ietf.org/id/draft-ietf-oauth-jwsreq-09.txt&url2=https://tools.ietf.org/id/draft-ietf-oauth-jwsreq-30.txt


IMPORTANT NOTICE: The contents of this email and any attachments are
confidential and may also be privileged. If you are not the intended
recipient, please notify the sender immediately and do not disclose the
contents to any other person, use it for any purpose, or store or copy the
information in any medium. Thank you.
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

v2.23.0 | Report a Bug | By Email