Re: [OAUTH-WG] New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
Torsten Lodderstedt <torsten@lodderstedt.net> Sun, 13 November 2016 05:59 UTC
Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD06129516 for <oauth@ietfa.amsl.com>; Sat, 12 Nov 2016 21:59:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.621
X-Spam-Level:
X-Spam-Status: No, score=-2.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gUoNTwCfaaWQ for <oauth@ietfa.amsl.com>; Sat, 12 Nov 2016 21:59:30 -0800 (PST)
Received: from smtprelay02.ispgateway.de (smtprelay02.ispgateway.de [80.67.31.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEBB612943A for <oauth@ietf.org>; Sat, 12 Nov 2016 21:59:29 -0800 (PST)
Received: from [58.120.104.2] (helo=[192.168.101.185]) by smtprelay02.ispgateway.de with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.84) (envelope-from <torsten@lodderstedt.net>) id 1c5np7-00041Y-CO; Sun, 13 Nov 2016 06:59:26 +0100
To: Justin Richer <jricher@mit.edu>
References: <147613227959.31428.2920748721017165266.idtracker@ietfa.amsl.com> <9CDE07EB-E5B4-43B2-B3C1-F12569CAB458@ve7jtb.com> <5827DE8A.4010807@lodderstedt.net> <4372F560-F98E-491B-BEDD-B02A2671D96C@mit.edu> <5827F848.3060803@lodderstedt.net> <2164E521-236F-46FC-AAF1-D2EE80F29BA9@mit.edu>
From: Torsten Lodderstedt <torsten@lodderstedt.net>
Message-ID: <58280139.2040505@lodderstedt.net>
Date: Sun, 13 Nov 2016 14:59:21 +0900
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.0
MIME-Version: 1.0
In-Reply-To: <2164E521-236F-46FC-AAF1-D2EE80F29BA9@mit.edu>
Content-Type: multipart/alternative; boundary="------------030609000504090809070103"
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC5uZXQ=
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/M2YW8EKqjNBGefM85HNe-qZSUaQ>
Cc: Nat Sakimura via Openid-specs-fapi <openid-specs-fapi@lists.openid.net>, "<oauth@ietf.org>" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Nov 2016 05:59:32 -0000
I understand. My point is different: the text seems to assume everybody is using client registration, but that's not the case. I would like to point out it makes sense to explicitely state the assumption that it is determined by client policy (indepedent of the way this policy is established). Am 13.11.2016 um 14:24 schrieb Justin Richer: > As part of the client’s registered data model. At least, based on how > our own implementation works (where we support client_secret_basic, > private_key_jwt, etc), that’s where we’d check to see if the client > was supposed to be using TLS auth or not. > > We don’t let clients switch away from their registered auth mechanism. > > — Justin > >> On Nov 13, 2016, at 2:21 PM, Torsten Lodderstedt >> <torsten@lodderstedt.net <mailto:torsten@lodderstedt.net>> wrote: >> >> Justin, >> >> Am 13.11.2016 um 13:39 schrieb Justin Richer: >>> Torsten, I believe this is intended to be triggered by the >>> tls_client_auth value specified in §3. >> >> in the token request? >> >>> >>> Nit on that section, the field name for the client metadata in >>> RFC7591 is token_endpoint_auth_method, the _supported version is >>> from the corresponding discovery document. >>> >>> — Justin >>> >> Torsten. >>>> On Nov 13, 2016, at 12:31 PM, Torsten Lodderstedt >>>> <torsten@lodderstedt.net <mailto:torsten@lodderstedt.net>> wrote: >>>> >>>> Hi John and Brian, >>>> >>>> thanks for writting this draft. >>>> >>>> One question: how does the AS determine the authentication method >>>> is TLS authentication? I think you assume this is defined by the >>>> client-specific policy, independent of whether the client is >>>> registered automatically or manually. Would you mind to explicitely >>>> state this in the draft? >>>> >>>> best regards, >>>> Torsten. >>>> >>>> Am 11.10.2016 um 05:59 schrieb John Bradley: >>>>> At the request of the OpenID Foundation Financial Services API >>>>> Working group, Brian Campbell and I have documented >>>>> mutual TLS client authentication. This is something that lots of >>>>> people do in practice though we have never had a spec for it. >>>>> >>>>> The Banks want to use it for some server to server API use cases >>>>> being driven by new open banking regulation. >>>>> >>>>> The largest thing in the draft is the IANA registration of >>>>> “tls_client_auth” Token Endpoint authentication method for use in >>>>> Registration and discovery. >>>>> >>>>> The trust model is intentionally left open so that you could use a >>>>> “common name” and a restricted list of CA or a direct lookup of >>>>> the subject public key against a reregistered value, or something >>>>> in between. >>>>> >>>>> I hope that this is non controversial and the WG can adopt it quickly. >>>>> >>>>> Regards >>>>> John B. >>>>> >>>>> >>>>> >>>>> >>>>>> Begin forwarded message: >>>>>> >>>>>> *From: *internet-drafts@ietf.org >>>>>> *Subject: **New Version Notification for >>>>>> draft-campbell-oauth-tls-client-auth-00.txt* >>>>>> *Date: *October 10, 2016 at 5:44:39 PM GMT-3 >>>>>> *To: *"Brian Campbell" <brian.d.campbell@gmail.com>, "John >>>>>> Bradley" <ve7jtb@ve7jtb.com <mailto:ve7jtb@ve7jtb.com>> >>>>>> >>>>>> >>>>>> A new version of I-D, draft-campbell-oauth-tls-client-auth-00.txt >>>>>> has been successfully submitted by John Bradley and posted to the >>>>>> IETF repository. >>>>>> >>>>>> Name:draft-campbell-oauth-tls-client-auth >>>>>> Revision:00 >>>>>> Title:Mutual X.509 Transport Layer Security (TLS) Authentication >>>>>> for OAuth Clients >>>>>> Document date:2016-10-10 >>>>>> Group:Individual Submission >>>>>> Pages:5 >>>>>> URL: >>>>>> https://www.ietf.org/internet-drafts/draft-campbell-oauth-tls-client-auth-00.txt >>>>>> Status: >>>>>> https://datatracker.ietf.org/doc/draft-campbell-oauth-tls-client-auth/ >>>>>> Htmlized: >>>>>> https://tools.ietf.org/html/draft-campbell-oauth-tls-client-auth-00 >>>>>> >>>>>> >>>>>> Abstract: >>>>>> This document describes X.509 certificates as OAuth client >>>>>> credentials using Transport Layer Security (TLS) mutual >>>>>> authentication as a mechanism for client authentication to the >>>>>> authorization server's token endpoint. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> Please note that it may take a couple of minutes from the time of >>>>>> submission >>>>>> until the htmlized version and diff are available at >>>>>> tools.ietf.org <http://tools.ietf.org/>. >>>>>> >>>>>> The IETF Secretariat >>>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> OAuth mailing list >>>>> OAuth@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/oauth >>>> >>>> _______________________________________________ >>>> OAuth mailing list >>>> OAuth@ietf.org <mailto:OAuth@ietf.org> >>>> https://www.ietf.org/mailman/listinfo/oauth >>> >> >
- [OAUTH-WG] Fwd: New Version Notification for draf… John Bradley
- Re: [OAUTH-WG] [Openid-specs-fapi] Fwd: New Versi… Preibisch, Sascha H
- Re: [OAUTH-WG] Fwd: New Version Notification for … Vladimir Dzhuvinov
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Vladimir Dzhuvinov
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Jim Manico
- Re: [OAUTH-WG] Fwd: New Version Notification for … Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Jim Manico
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Sergey Beryozkin
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… John Bradley
- Re: [OAUTH-WG] New Version Notification for draft… Phil Hunt (IDM)
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Phil Hunt (IDM)
- Re: [OAUTH-WG] New Version Notification for draft… Vladimir Dzhuvinov
- Re: [OAUTH-WG] New Version Notification for draft… Sergey Beryozkin
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] Fwd: New Version Notification for … Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] Fwd: New Version Notification for … Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Samuel Erdtman
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico