IETF Logo Mail Archive

Re: [OAUTH-WG] WGLC on "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens"

George Fletcher <gffletch@aol.com> Tue, 24 March 2020 18:47 UTC

Return-Path: <gffletch@aol.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CB6C3A122A for <oauth@ietfa.amsl.com>; Tue, 24 Mar 2020 11:47:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.561
X-Spam-Level:
X-Spam-Status: No, score=-3.561 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-1.463, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aol.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IZmMHlrYT7z for <oauth@ietfa.amsl.com>; Tue, 24 Mar 2020 11:47:44 -0700 (PDT)
Received: from sonic313-9.consmr.mail.ne1.yahoo.com (sonic313-9.consmr.mail.ne1.yahoo.com [66.163.185.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B27BA3A1232 for <oauth@ietf.org>; Tue, 24 Mar 2020 11:47:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aol.com; s=a2048; t=1585075663; bh=o94Cko9SuAyLe4xbeSZDwL2ocZdn8dCFEybJhcJ9dkY=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=sg9i3ekGr2E9pbA/M5riN81vqaFfqKq407n2OHoAW8mHgaT+TXdF9vQ/DcYjAFi9hnxHpnmc7k3OZtEo2G89LV9njmdyfhBzcDePSxG1SnTMtDcTM7c0fc3oTTzqFejwao8ewdT6YjjTKty4PaEDccXyVwrUjadHupT1zeq8zu4aBC9M21kP1ruhWRbcQK2qY37OY+ebwzCwbwGAHuKEtyM+EjF8zbgpppkJjXJ5cVH1sTd2vFBSMrxeEijE6Y7z0KyZWqUphxVLYvuUPyDlvfPnjsF5er3E8+kkJPKcOuF0t6DoD2vbWxBZGz7RGwaW8pueu8YCSNH8HejqGnPGIg==
X-YMail-OSG: sfeRUq8VM1lUV_w9j_RXuZySYeZOooTERSSfO31.ndvY7vPsSG.ilfkw70X8Te6 Ua5B9uN9gxNEgRvocNtQjHh7PvdF91Bt5vCqDjhSvR4kENSqQe6D9L5wQJCjtCDKYIOwDFIpBhuq hR.X98KqkdMU7dE1mNpW2WKJLJVLj5PZrBIMEJ1EGQ2sHEZBRCLU9cWh2qV7edO37uCYdgXPpoJM pN7VrLqDrUdj7iEsjXdvc5N8YIa4R_UPX0glIrkyln2eeZ2OkbkrJCjIloYmQJcWWtL8AXqmRn9E 9t.Sv4MFXkMM6wdvXI4KCWjhpv_OqMd9KBPWYVUZtTrdoJg_pvCVRy104kuxDMUC8BUFfPae6N2v bIKRq6gH8lPeTiJDOqz2jUjIHo1ofDk1DzLihe11CvbtFmKKq3IrzFe5ytiOq5iwQo9ujtvne7zR LvkcL056kQs2g_B6fo3t8Jsewp9.KJ6ASHtU3JmPRayeZy8q6nlh.VzRlFi75.5lz0OuAZMydRl0 sb10AVNfiSx.hJUMom.eiyIWz8Gt3IyrTtD2oI9KSsntl0qvqofwlGHJPBHwsOlQ9UHgw8lbe8D. LH2P_zpfAKObin38Ggfx64ohNsSTlKsZMEEpKpDPpXuI15CHRtXgU9sHlUPQvGKd28IpUUayFzWO kZUyZmQO0bWLGCgirgUbT8OQfzEYgh2bjNvSP0PCxkM4RT5bMWMn1c2lJ3bPnKHsvtdv2ss6_nYs mGHOvF7SLBeHRnIzlcfTwOInOtc_SOsZdUMSOfSK3SVAWdXAo0sdhYBkthFrRS.wyPeVk2oToV2D 3yHMrQPcbOmIIyt1tieAOKVwzvpcRcFiS6DtmMIK1H8xix4WWbwHrH1ROfP8bzC0H3n_931JaC3V TWTySPzOavRB4vvlTo4KjI13W4Y.vhTKHpeglmIKl8jO6YPw28ztdxHI7MBeonE.txTDbQ6PZE6x waYM0RH0258fBps_ImhrZ9pN0NkJOnlrwEyZ5KFqThnq7JcJWqDTLqoJgIQ5SCO9QwwzdkhVkZwx bcv5pmxwamixCHyxapk.yawLsBrvnMGRXVc4QyMhdywRHjpz2TjCG9wRp4GK0YvptHNoiotCVu_Z cOjBdx9u5alZ.mH1O26rSJdrSAc2ATOTcors6Rcugfu9LvzDs5IP2LR8QP8h6MI6AK8M7uBo8oPJ eXfXIOosTFq5Az49VqYe06jEnlnVnX_ixZCAElN_Fk9cgl2kf196_WybFUEeMuJFlIn9P3LRPxAq mz.vGqa1_2xQknrwjjvlv0dINvcSPa7Nfw0PIkJTwejGUtFRy28_HbOY.xNEGQ2EyZOuj6c6OiIf gxaaAFoLYIPKOs2CtbmoxC.AQ_RZiku4E13HATrD..__TwCVsXH0Ioa0TJrNXKO4Mmtk-
Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Tue, 24 Mar 2020 18:47:43 +0000
Received: by smtp424.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 588575f2a981cbb14b18292535530e16; Tue, 24 Mar 2020 18:47:37 +0000 (UTC)
To: Vittorio Bertocci <Vittorio=40auth0.com@dmarc.ietf.org>, Takahiko Kawasaki <taka@authlete.com>
Cc: oauth <oauth@ietf.org>
References: <AM0PR08MB37160B8A021052198699CD17FAF00@AM0PR08MB3716.eurprd08.prod.outlook.com> <01ec01d6017c$162eb2e0$428c18a0$@aueb.gr> <CAHdPCmMzRn8iYG025Vq0sQNzgZTOkQJuMJwttDgjMDLESpjptw@mail.gmail.com> <CAO_FVe5UXY4Jxd3LdG6zyXJ8B8nFKYevcHQTVJEAFSdW0ku9tg@mail.gmail.com>
From: George Fletcher <gffletch@aol.com>
Organization: AOL LLC
Message-ID: <52f18114-4f8e-da86-5735-4c4e8f8d2db5@aol.com>
Date: Tue, 24 Mar 2020 14:47:35 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.5.0
MIME-Version: 1.0
In-Reply-To: <CAO_FVe5UXY4Jxd3LdG6zyXJ8B8nFKYevcHQTVJEAFSdW0ku9tg@mail.gmail.com>
Content-Type: multipart/alternative; boundary="------------476B3C00BA4A3369BEF01678"
Content-Language: en-US
X-Mailer: WebService/1.1.15518 hermes Apache-HttpAsyncClient/4.1.4 (Java/1.8.0_242)
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Mq0DNhgMuVmdqknnb4KA9WiSISI>
Subject: Re: [OAUTH-WG] WGLC on "JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens"
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Mar 2020 18:48:04 -0000

Focusing just on this comment...

This assumes the system uses a specific implementation of scopes values 
(e.g. 'read', 'write', 'delete'). It is very possible that in the 
context of a calendar services and an inbox service... the system 
defines scopes like 'cal-r', 'cal-w', 'mail-r', mail-w' in which there 
is no ambiguity.

On 3/24/20 2:14 PM, Vittorio Bertocci wrote:
>    I don't think the rule referring to the "scope" parameter is worth being
>> defined. That "aud" is missing but "scope" is available is enough for
>> resource servers. In other words, if "aud" is determined based on the
>> "scope", why do we have to set "aud" redundantly?
> Scope is actually not sufficient for many resource servers. Whenever an RS
> is facading a collection of existing finer grained resources, scopes
> representing permissions might be ambiguous - if my API facades both
> calendar and inbox, what does the "read" scope refer to? Having an audience
> resolves that ambiguity.

v2.23.0 | Report a Bug | By Email