Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint

[Brian Campbell <[e-mail]>]

It doesn't seem like that confusing or large of a change to me - if the
client is doing MTLS and the given endpoint is present in `mtls_endpoints`,
then it uses that one.  Otherwise it uses the regular endpoint. It gives an
AS a lot of flexibility in deployment options. I personally think getting a
307 approach deployed and working would be more complicated and error
prone.

It is a minority use case at the moment but there are forces in play, like
the push for increased security in general and to have javascript clients
use the code flow, that suggest it won't be terribly unusual to see an AS
that wants to support MTLS clients and javascript/spa clients at the same
time.

I've personally wavered back and forth in this thread on whether or not to
add the new metadata (or something like it). With my reasoning each way
kinda explained somewhere back in the 40 or so messages that make up this
thread.  But it seems like the rough consensus of the group here is in
favor of it.




On Fri, Feb 1, 2019 at 3:18 PM Richard Backman, Annabelle <richanna=
[e-mail]> wrote:

> This strikes me as a very prominent and confusing change to support what
> seems to be a minority use case. I’m getting a headache just thinking about
> the text needed to clarify when the AS should provide `mtls_endpoints` and
> when the client should use that versus using `token_endpoint.` Why is the
> 307 status code insufficient to cover the case where a single AS supports
> both mTLS and non-mTLS?
>
>
>
> --
>
> Annabelle Richard Backman
>
> AWS Identity
>
>
>
>
>
> *From: *OAuth <[e-mail]> on behalf of Brian Campbell
> <bcampbell=[e-mail]>
> *Date: *Friday, February 1, 2019 at 1:31 PM
> *To: *George Fletcher <gffletch=[e-mail]>
> *Cc: *oauth <[e-mail]>
> *Subject: *Re: [OAUTH-WG] MTLS and in-browser clients using the token
> endpoint
>
>
>
> Yes, that would work.
>
>
>
> On Fri, Feb 1, 2019 at 2:28 PM George Fletcher <gffletch=
> [e-mail]> wrote:
>
> What if the AS wants to ONLY support MTLS connections. Does it not specify
> the optional "mtls_endpoints" and just use the normal metadata values?
>
> On 1/15/19 8:48 AM, Brian Campbell wrote:
>
> It would definitely be optional, apologies if that wasn't made clear. It'd
> be something to the effect of optional for the AS to include and clients
> doing MTLS would use it when present in AS metadata.
>
>
>
> On Tue, Jan 15, 2019 at 2:04 AM Dave Tonge <[e-mail]>
> wrote:
>
> I'm in favour of the `mtls_endpoints` metadata parameter - although it
> should be optional.
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited..
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>
> _______________________________________________
>
> OAuth mailing list
>
> [e-mail]
>
> https://www.ietf..org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>
>
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited..
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._