IETF Logo Mail Archive

Re: [OAUTH-WG] Benjamin Kaduk's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)

Brian Campbell <bcampbell@pingidentity.com> Thu, 13 August 2020 21:01 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE8FC3A05A7 for <oauth@ietfa.amsl.com>; Thu, 13 Aug 2020 14:01:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=pingidentity.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QozjS7_nhw6U for <oauth@ietfa.amsl.com>; Thu, 13 Aug 2020 14:01:01 -0700 (PDT)
Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 32FEC3A0593 for <oauth@ietf.org>; Thu, 13 Aug 2020 14:01:01 -0700 (PDT)
Received: by mail-lj1-x22b.google.com with SMTP id f26so7692944ljc.8 for <oauth@ietf.org>; Thu, 13 Aug 2020 14:01:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pingidentity.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DkDCNfr6dEiFmeBiQsqGfwFDU4Fm7kXTx4fnIhh9Fjs=; b=aCDgVvBS6zI/0aIFzhpKRcHHOvyAx8U93Ddnhv0kmYnCF7LOIdwvgLV3Mt6F2dWKki OA1ysJn32TsEz4JXIGRZgtrAju4kbxYSOgwi+mb8Ml1gGaPtQANgjjRr1d/FHpYvTv// Y8kufCtZWX15af1JaXroyM1L+hv79waJXog1J2QgmtCvMo52gnthkzIQ3dvT3K3JeeCV NNV+MCvIU/3Lm6JV+YjAbIiUUwO/2ML24aS74TgUSOqHaal0i7zuIASPEcTfgX8uEZY9 cY5090wDiSKM+o4emb8DdhGb84P86UTjbxEvS33gNytk9Qd/pvoc4LmWJFv6Wdt1jYVX x35w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DkDCNfr6dEiFmeBiQsqGfwFDU4Fm7kXTx4fnIhh9Fjs=; b=YHV6VtYsGFPK3biFr2MN8pLUJtTAknVDJHj9ZMmYhwLAJnV41VPbYlIh/t08gMYabi PgI8ryqk/pm4P+UA7dQaPNpscx4c98fhOEFQ9CEZiXR6OZnsyKV7JEwPa9NqWsKllRuf wT5S8mUMl3HYmylgeM9Y07ZQ36uoAWkH5e5f7Zc+RKsz3JGdzwxLrbt67CV7sBgD5prh RxZeYcBDKUErMImjFetgNBnOBpBSKEzDnOZi/UMLQqKiZl+wH30XLnXlzkwgPys9uykb aAYX50818sg7B2PL1fl3xiR4XZb9S2yTkYOLJMM7bh8d9P3i0DG1b/4S3RADM9J0ZghE GE8g==
X-Gm-Message-State: AOAM532JZugZnsaIFlzlIl5Uo8KBKTOrTiRiK6vAWVtuOh1fQofHP4dw vb3kEcL484QtGWhMSFwqpagBu5WuMwquq8MNYN/HcNfS937bZY+Bny7Rzft89bpJG7WecWPvkDl P7lB6wShVGg+meQ==
X-Google-Smtp-Source: ABdhPJxaVJwJSxJl1j54AU7Yd9cDacKjbeD5+fP/Zwlmc82INX+6V0tICXFWMcImNo/MAH9jQFdX9S3A3If+z7/DzSU=
X-Received: by 2002:a2e:83d5:: with SMTP id s21mr2379722ljh.280.1597352459333; Thu, 13 Aug 2020 14:00:59 -0700 (PDT)
MIME-Version: 1.0
References: <159717903728.5275.9808713434051601265@ietfa.amsl.com>
In-Reply-To: <159717903728.5275.9808713434051601265@ietfa.amsl.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Thu, 13 Aug 2020 15:00:33 -0600
Message-ID: <CA+k3eCTXdHFtb88ow-0UT_hd1EzGzTfuA1FrfZsSm-LuFQZWow@mail.gmail.com>
To: Benjamin Kaduk <kaduk@mit.edu>
Cc: The IESG <iesg@ietf.org>, oauth <oauth@ietf.org>, oauth-chairs@ietf.org, draft-ietf-oauth-jwsreq@ietf.org
Content-Type: multipart/alternative; boundary="000000000000eb940f05acc899db"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/POfiIMFXpUQTl5nPvgb7YDcLkE0>
Subject: Re: [OAUTH-WG] Benjamin Kaduk's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 13 Aug 2020 21:01:06 -0000

While some discussion of why explicit typing was not used might be useful
to have, that thread started with a request for security considerations
prohibiting use of the "sub" with a client ID value. Because such a request
JWT could be repurposed for JWT client authentication. And explicit typing
wouldn't help in that situation.

On Tue, Aug 11, 2020 at 2:50 PM Benjamin Kaduk via Datatracker <
noreply@ietf.org> wrote:

>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> [updated to note that, per
> https://mailarchive.ietf.org/arch/msg/oauth/Lqu15MJikyZrXZo5qsTPK2o0eaE/
> and the JWT BCP (RFC 8725), some discussion of why explicit typing is not
> used would be in order]
>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

v2.23.0 | Report a Bug | By Email