Re: [OAUTH-WG] Signatures...what are we trying to solve?

George Fletcher <> Tue, 28 September 2010 15:38 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A57DE3A6D24 for <>; Tue, 28 Sep 2010 08:38:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.669
X-Spam-Status: No, score=-1.669 tagged_above=-999 required=5 tests=[AWL=0.929, BAYES_00=-2.599, HTML_MESSAGE=0.001]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id mb+R4ai2Jfqi for <>; Tue, 28 Sep 2010 08:38:03 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id C9BF03A6953 for <>; Tue, 28 Sep 2010 08:38:02 -0700 (PDT)
Received: from ( []) by (8.14.1/8.14.1) with ESMTP id o8SFcZjI017898; Tue, 28 Sep 2010 11:38:35 -0400
Received: from palantir.local (unknown []) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by (MUA/Third Party Client Interface) with ESMTPSA id 9FEC0E0000AF; Tue, 28 Sep 2010 11:38:35 -0400 (EDT)
Message-ID: <>
Date: Tue, 28 Sep 2010 11:38:36 -0400
From: George Fletcher <>
Organization: AOL LLC
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv: Gecko/20100915 Thunderbird/3.1.4
MIME-Version: 1.0
To: OAuth WG <>
References: <>
In-Reply-To: <>
Content-Type: multipart/alternative; boundary="------------030002080708040809080202"
x-aol-global-disposition: G
X-AOL-SCOLL-SCORE: 0:2:414250016:93952408
x-aol-sid: 3039ac1d33844ca20bfb0760
Subject: Re: [OAUTH-WG] Signatures...what are we trying to solve?
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 28 Sep 2010 15:38:04 -0000

  I think of the signature issues as falling into two classes... I think 
they map to your classification as well...

    * *Signing tokens* is important for interoperability especially
      looking forward to a time when tokens issued by multiple
      Authorization Servers are accepted at a given host.
    * *Signing messages* is important because it provides a mechanism to
      ensure that the entity making the API call (and presenting an
      access token) is really the entity that is allowed to make the API

Signing messages applies to the re-delegation use cases. I've heard the 
need for this class of use cases from both the hData (health data) 
community as well as the user managed access (UMA) community.

Signing tokens covers both your second class of tokens as well as 
another use case that Eran has mentioned as well. Namely, a protected 
resource server honoring tokens from multiple Authorization Servers.

These are the two classes of use cases that I'd like to see solved.


On 9/28/10 12:58 AM, David Recordon wrote:
> If you know me then you'll know that I'm generally one of the last 
> people to talk about Alice and Bob. That said, there are a lot of 
> technical proposals flying across the list with very little shared 
> understanding of the problem(s) we're trying to solve.
> From what I've seen there are two distinct classes of signature use cases.
> 1) The first is where the HTTP request parameters must be part of the 
> signature. An example is any OAuth 1.0a style API where you want to 
> make sure that the HTTP POST your server just received isn't 
> masquerading itself as a GET.
> 2) The second is where the HTTP request is orthogonal. An example 
> is OpenSocial where the server is sending state information to the 
> client such as what user is currently logged in.
> The main practical example I have of the first use case is what 
> Twitter wants to do with redelegation. In this case TweetDeck can't 
> given TwitPic it's own bearer token, but needs to sign the POST 
> request and pass that signature to TwitPic for it to include in the 
> final API request to Twitter.
> In terms of signing protected resource requests, I haven't heard 
> anyone bring up specific and detailed needs for this recently.
> JSON tokens pretty clearly make sense for the second class of 
> signature use cases and it's actually a bit hard to argue why they 
> would be a part of OAuth. Facebook shipped this a bit over a month ago 
> for canvas applications. We include a `signed_request` parameter which 
> is signature.base64url(JSON). Parsing it is 18 lines of PHP. 
> This second class of use case will also be required by OpenID Connect 
> where the server is signing identity information and sending it to the 
> client. I imagine that OpenSocial will also still have it and wish to 
> continue relying on public key algorithms.
> So a few questions:
>  * Do we want to tackle both of these classes of signatures in OAuth?
>  * Why do you consider the second class part of OAuth versus something 
> completely separate that might happen to include an OAuth access token?
>  * Is the Twitter redelegation use case the right focus for the first 
> class?
>  * Is there an example of an OAuth 2.0 server that can't use bearer 
> tokens for protected resource requests and thus requires signatures?
> Thanks,
> --David
> _______________________________________________
> OAuth mailing list