From sachinmamoru@gmail.com Tue Feb 20 03:01:18 2024 Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3359C14F69F for ; Tue, 20 Feb 2024 03:01:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.085 X-Spam-Level: X-Spam-Status: No, score=-7.085 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Kb-D1inr11x for ; Tue, 20 Feb 2024 03:01:14 -0800 (PST) Received: from mail-yw1-x1130.google.com (mail-yw1-x1130.google.com [IPv6:2607:f8b0:4864:20::1130]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F632C14F5FE for ; Tue, 20 Feb 2024 03:01:14 -0800 (PST) Received: by mail-yw1-x1130.google.com with SMTP id 00721157ae682-608170eb5efso25268547b3.3 for ; Tue, 20 Feb 2024 03:01:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708426873; x=1709031673; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=uKG7P2FPxFdWyFQXlLVN0OX1jJKINHQkToueUZpdkUs=; b=Hd6uSvNaS3sHWwEVYAs4gms7Zx4Zh+tAHBAZ9VtSThlyCF40qZeP8QgefsM10dnY3g HYRcA4tAUJJQnl2AGbaBozmR7EWOk5YaO7gt5gc1/HvgQZ5KbVd1sgeLcZlyEBVGF++h Zmsw+/is2DWKNd3ieAkBXG5Ko559cxTr+uN5LoExb/CN8uWcbeO20u+8LbFnvBRwIDY6 cTK+ea9uycPpg0vsmCB3oEIPx46YxecWjjPb+FUAAj1cE7qa+2kds0IDF+0kvuqUAKDR RkpoK6lRQWWi1i57SObIzsy894oEvnlKt/sbKXP5clIFsZ68OMcaK8b+i3ak3+ItApQ8 Nx0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708426873; x=1709031673; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=uKG7P2FPxFdWyFQXlLVN0OX1jJKINHQkToueUZpdkUs=; b=tVom7M9ebMTHYljtYyBtv99439Ew4Qe3FXxl2TWesILK2pp4tG2F0/m+423J7+XyFt z2rSsI6cyQL/A9Rp5pSXbQcGGwbbCJMMuXJjXmchm7981c74DXh9vGL8ZGWL/HzCCm+P fZaTYQFXknahekzUhB+/n3pebTLLUJ7wXM4NlbHNpXlE6U8wgMq76Od0/zVQPLKgnbml f9lcISLeE87gqahV/XSabC+hHouf0MEqujOEqPpzpp8XRDH2Ea8Z771UJ0zTKdV7NEmS Q0zyWOBN2PY/YYFrBd5T6/exdIGEaYwSA4E11w2JWqZkPT02jJiO7Ht8T9oBsz2Ppk7Z z3hA== X-Gm-Message-State: AOJu0YzblATsUwIZzb3qsb9pPwdq+pidMFYUS2v9azDVWZ7GRaQdbBQm O47kciQkeVWG9FeKABZigZMz9ZWsZPmQvxKN3q3bb6d48munRWHEDLOuzXVwUYpYcjnNghqY8Xk 9lc+qPGl8Yd2AP/k9WH8R/MiB77kDccIPX+4FIA== X-Google-Smtp-Source: AGHT+IFBsJXgC9fu67Jtcm9kpbywbFUADRw4xpII+4qM4w6Jm+EG1k99T2LHZvqxACfVJFsVwkYZmr4D3FpvS8cql1Q= X-Received: by 2002:a81:73d6:0:b0:607:60a5:8448 with SMTP id o205-20020a8173d6000000b0060760a58448mr14834206ywc.0.1708426873494; Tue, 20 Feb 2024 03:01:13 -0800 (PST) MIME-Version: 1.0 References: <9D9E6142-0C87-4140-BB9F-AE3B89A44BCB@gmail.com> In-Reply-To: <9D9E6142-0C87-4140-BB9F-AE3B89A44BCB@gmail.com> From: Sachin Mamoru Date: Tue, 20 Feb 2024 16:31:02 +0530 Message-ID: To: Neil Madden Cc: oauth@ietf.org, janak@wso2.com, thilinasenarath97@gmail.com Content-Type: multipart/alternative; boundary="000000000000eb5ffa0611ce209e" Archived-At: Subject: Re: [OAUTH-WG] Evaluation of Scope Management in Refresh Token Behavior X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Feb 2024 11:01:19 -0000 --000000000000eb5ffa0611ce209e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 20 Feb 2024 at 12:23, Neil Madden wrote: > > On 20 Feb 2024, at 06:44, Sachin Mamoru wrote: > > =EF=BB=BF > Hi All, > > When we request an access token using 3 scopes (scope1, scope2, scope3). > > Then will receive a refresh token (refresh_token1) with the access token. > > After that will request another access token with refresh_token1 and > provide the scope list as scope1 and scope2 (Narrow down scopes). > > Similarly, get another refresh token (refresh_token2) with the access > token. > > Now if we request another access token with refresh_token2, we cannot > request scope3, instead, we can either request both scope1 and scope2 or > one of them. > > But in the specification, didn't able to find anything related to > narrow-down scopes with refresh token. > > From Spec > > 1.5. Refresh Token - Refresh tokens are issued to the client by the > authorization server and are used to obtain a new access token when the > current access token becomes invalid or expires or to obtain additional > access tokens with identical or narrower scope (access tokens may have a > shorter lifetime and fewer permissions than authorized by the resource > owner). > > 6. Refreshing an Access Token > > The scope of the access request as described by Section 3.3. The > requested scope MUST NOT include any scope not originally granted by the > resource owner, and if omitted is treated as equal to the scope > originally granted by the resource owner. > > https://datatracker.ietf.org/doc/html/rfc6749 > > > IMO, from a security aspect, the current behaviour is much more secure > because it is designed to maintain the principle of least privilege, wher= e > it updates the refresh token authorised scopes based on the requested one= s. > > > What should be the correct behaviour? > narrow-down scope refresh token should also be able to request access > token with original scope list? > > > Also from section 6: > > If a > new refresh token is issued, the refresh token scope MUST be > identical to that of the refresh token included by the client in the > request. > > > > > > =E2=80=94 Neil > > --=20 Sachin Mamoru Software Engineer, WSO2 +94771292681 | sachinmamoru.me sachinmamoru@gmail.com --000000000000eb5ffa0611ce209e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Tue, 20 Feb 2024 at 12:23, Neil Madden <neil.e.madden@gmail.com> wrote:<= br>

On 20 Feb 2024, at 06:44, Sachin Mamoru <sachinmamoru@gmail.com= > wrote:

=EF=BB=BF
Hi All,

When we request an access token u= sing 3 scopes (scope1, scope2, scope3).

Then will receive a refresh token (= refresh_token1) with the access token.


After that will request another access token with refresh_token1 an= d provide the scope list as scope1 and scope2 (Narrow down scopes).<= /span>

Similar= ly, get another refresh token (refresh_token2) with the access token.


Now if we request another access tok= en with refresh_token2, we cannot request scope3, instead, we can either re= quest both scope1 and scope2 or one of them.


But in the specification, didn't able to find anythin= g related to narrow-down scopes with refresh token.


From Spec=


1.5.=C2=A0 Refresh Token -=C2=A0Refresh tokens are= issued to the client by the authorization server and are=C2=A0used to obtain a n= ew access token when the current access token=C2=A0becomes invalid or expires or = to obtain additional access tokens=C2=A0with identical or narrower scope (access = tokens may have a shorter=C2=A0lifetime and fewer permissions than authorized by = the resource=C2=A0owner).


<= /font>

6.=C2=A0 Re= freshing an Access Token

<= span style=3D"color:rgb(0,0,0);background-color:transparent;font-variant-nu= meric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;= vertical-align:baseline">The scope of the access request as described by=C2= =A0Sec= tion 3.3.=C2=A0 The requested scope MUST NOT include any scope=C2=A0= not originall= y granted by the resource owner, and if omitted is=C2=A0treated as equal to the = scope originally granted by the=C2=A0resource owner.


https:/= /datatracker.ietf.org/doc/html/rfc6749


IMO, from a= security aspect, the current behaviour is much more secure because it is d= esigned to maintain the principle of least privilege, where it updates the = refresh token authorised scopes based on the requested ones.


<= /p>

What should be the correct behaviour?
narrow-down scope refresh token = should also be able to request access token with original scope list?


Also from section 6:

If a
   new refresh token is issued, the refresh token scope MUST be
   identical to that of the refresh token included by the client in the
   request.
=




=E2=80=94 Neil
<= /div>

--
=C2=A0
Sachin Mamoru
Software Engineer, WSO2
+94771292681
| sachinmamoru.me=C2=A0<= /a>
sa= chinmamoru@gmail.com=C2=A0
<= table border=3D"0" cellpadding=3D"0" cellspacing=3D"0">
3D""
--000000000000eb5ffa0611ce209e--