IETF Logo Mail Archive

Re: [OAUTH-WG] DPoP introspection not including verification

Dick Hardt <dick.hardt@gmail.com> Fri, 15 March 2024 12:48 UTC

Return-Path: <dick.hardt@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E867C14F6FC for <oauth@ietfa.amsl.com>; Fri, 15 Mar 2024 05:48:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.104
X-Spam-Level:
X-Spam-Status: No, score=-2.104 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XBm2mzTdjMX8 for <oauth@ietfa.amsl.com>; Fri, 15 Mar 2024 05:48:26 -0700 (PDT)
Received: from mail-yb1-xb33.google.com (mail-yb1-xb33.google.com [IPv6:2607:f8b0:4864:20::b33]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07DADC14E515 for <oauth@ietf.org>; Fri, 15 Mar 2024 05:48:20 -0700 (PDT)
Received: by mail-yb1-xb33.google.com with SMTP id 3f1490d57ef6-dcc7cdb3a98so1952785276.2; Fri, 15 Mar 2024 05:48:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1710506900; x=1711111700; darn=ietf.org; h=cc:to:subject:message-id:date:from:reply-to:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=e6VS8Zhfncx0Q+NDU27qZhZ1GkCHn2WhU4ckU/z6T/w=; b=e2+ddl9CsMY55A+6W/FIa5TsywRiz9XRgGkWj6TzodpQPFQD7LUEXeTtyp+4LqHTIu LCbGPsnPslUJubG5Irf5xAeSWZ1j/OuQO81TdtRpZJf6WluR3J8o3h762UszjeHKjJZn at/RTBXWy/AIkrnMN6wyEgYdnAm5mf+Tv4X4YtC+mp4aPoYw1ufkvzXpfdPk63EqLEf+ aRRKu9zUM1YGIzCyG0/gwNVFfrphwnuf7yekux/iyIqt89l67YcRgYhkqA1CeXLiXo3g 27esEhkFDxd5Eb8pebSW2FO+ZcCqAy4tv/lx6E29cPdIR7+E4cQ7l1GZXtClCLPnwCPj Mlbw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1710506900; x=1711111700; h=cc:to:subject:message-id:date:from:reply-to:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=e6VS8Zhfncx0Q+NDU27qZhZ1GkCHn2WhU4ckU/z6T/w=; b=vl//QmlP8l606Vjm3yvZTa9FQx/kqeH4+kY+dccwHAR3HzioDxvZ2ZzyAGHNFin8Yk m4eIi5jcVJ6dDD1z2ocOT7XwnV1W2RkIjIRe1+TVNi84OyNEpb9zhG5SbH2WfNK5MSwC 7yCcZLTkA/0K21q/1FCs87jy15fQPHMOOgNDk8jJf3YPqvOh0Vyi3HhPFoQk+15tUnXp l5s9CSXioEZ+UF6NELQ0GrLFC4degdUkgtF+wz6gDD2uZkabANa5uRLUjvBe4ZUsHQ2C HsEbn5qnUcFhDQiM+8AE5aFEAHNf0eDqvxbV10toM52pI1UFevs1iBDC1wZlDyoCgWJQ VFHQ==
X-Forwarded-Encrypted: i=1; AJvYcCWnxVzQjauHbH9RxF9vJj4Mc/tzTQzYNrt/xKeRAnXFleJBGTLBewPbHuvba141CdMJEdIy7naKQnKlq/iut/kaKHrfSGL44BDQbz+yGlncCg==
X-Gm-Message-State: AOJu0YxbW1OwjkZeAmHsB2CT/ral4qOkvIClNY59WoovfGfn2Wt1z0Wt 3VUs7VHPPWyZSX9CD+xNgntgjXPR1CtZkhk2+9EVmPYQ2B09doG98sWndzGCtTLT/yl6/bjdm3q ofwpjBv5nxrymOCHnvZ4j93Hjay4=
X-Google-Smtp-Source: AGHT+IElj/r4MY+B0HhsxvUV6gHxAAzTT2ooAuCli+a70vegF5EzEBBqN1f8orzzFxxXdbQrSJodjhZMKvVFWbejwLE=
X-Received: by 2002:a25:2689:0:b0:dcc:8d09:c7c4 with SMTP id m131-20020a252689000000b00dcc8d09c7c4mr4639513ybm.7.1710506898668; Fri, 15 Mar 2024 05:48:18 -0700 (PDT)
MIME-Version: 1.0
References: <CAD9ie-u5cuo_=Rrfez2k1SJ6mSSAJiN61SL44ktEaqj+_wKRMA@mail.gmail.com> <36D69C8F-1947-4A1B-81AB-778465E6CEF7@mit.edu>
In-Reply-To: <36D69C8F-1947-4A1B-81AB-778465E6CEF7@mit.edu>
Reply-To: Dick.Hardt@gmail.com
From: Dick Hardt <dick.hardt@gmail.com>
Date: Fri, 15 Mar 2024 05:48:06 -0700
Message-ID: <CAD9ie-t1drdnHzg9cfED6whLXGA58DtV_Y9RcoVUHdRf-5ToyA@mail.gmail.com>
To: Justin Richer <jricher@mit.edu>
Cc: Brian Campbell <bcampbell@pingidentity.com>, Daniel Fett <fett@danielfett.de>, "oauth@ietf.org" <oauth@ietf.org>, "rfc9449@ietf.org" <rfc9449@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000014c3900613b26ca3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/J8HW_5hPk2nuxem-kx3Y_G7WpEE>
Subject: Re: [OAUTH-WG] DPoP introspection not including verification
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Mar 2024 12:48:26 -0000

Understood

On Thu, Mar 14, 2024 at 9:58 PM Justin Richer <jricher@mit.edu> wrote:

> While I don’t have an answer for the question asked, I do want to note
> that in order to do a proper validation, the introspection request would
> have to include the values of the DPoP proof, but also the expected HTM and
> HTU values from the RS, as the AS would not know these directly.
>
> — Justin
>
> On Mar 10, 2024, at 4:05 PM, Dick Hardt <dick.hardt@gmail.com> wrote:
>
> Hey
>
> I was reading over RFC 9449 and was surprised that introspection did not
> take the DPoP header so that the introspection endpoint could do the check
> on the DPoP proof rather than forcing the Resource Server to do it.
>
>
> https://datatracker.ietf.org/doc/html/rfc9449#name-jwk-thumbprint-confirmation-
>
> Curious what was the reasoning behind this?
>
> /Dick
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>

v2.23.0 | Report a Bug | By Email