Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt

Brian Campbell <> Wed, 02 November 2016 21:03 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 96BDA1296B5 for <>; Wed, 2 Nov 2016 14:03:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 19nHyiyaKyn3 for <>; Wed, 2 Nov 2016 14:03:47 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4003:c06::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C4BD9129453 for <>; Wed, 2 Nov 2016 14:03:47 -0700 (PDT)
Received: by with SMTP id x4so38075085oix.2 for <>; Wed, 02 Nov 2016 14:03:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=uhqJs9p4zR2KTuEBhyrjUGan1Yx/ut1ZWhS3Q7V6u6M=; b=Ktsn3rsX0u+nm/wnoR5ig7I/RiNBmB7wbZVK0k7s9jkYaAB2W4U+PagBYx5EOmkeG6 FoiwUORewK/dGHnD43XBq1xgk6K7XFzWmsxtmINgjnx1Z3tgAEmQexwGqFXYu+/Nyf6t wi+7c3tLMXL76n2Ali3zMMBSWJafehtyNVemI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=uhqJs9p4zR2KTuEBhyrjUGan1Yx/ut1ZWhS3Q7V6u6M=; b=DzdfRbcN6HZ/EQWt/HSc1fvS6h7eqAjqyiOwnTS5gXOu69c6zr0uJZeGMp9CqGfel6 BCUzlvwwwJCZ+DRlRra5Uhzf8LC+kkgBYzOCMgOpyOPStpCUD07qXGtEJNzRTb3WsZ3C Bewcycp+v9FOyjgn/zAZIFb2/Jmk6VIhLsLxxQ1k9GMDfq/u3MubHo1kdoUZkv5kn6E4 pOqQL1f0yKaBEIkayHDkPV1mCCS7yWjoG3q56EVtEaYJZirV6jakJ4Hy6okjC9uc3HA4 PgvaLqbzs3EoS85J+CmwW/mXR/S+w5dO/uJa+6X1SXjwUP+dATLewF8LQehNSeBopkLK UG1w==
X-Gm-Message-State: ABUngveBv5xSvS326VSwTrGkSL6Ms5Klx7pogiGmYBs8XyJ8GZvoE4xGf+yBohghc5h0R+g1yApYHPpGhsnFQnao
X-Received: by with SMTP id z83mr6050369iof.156.1478120626672; Wed, 02 Nov 2016 14:03:46 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Wed, 2 Nov 2016 14:03:16 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <>
From: Brian Campbell <>
Date: Wed, 02 Nov 2016 15:03:16 -0600
Message-ID: <>
To: Samuel Erdtman <>
Content-Type: multipart/alternative; boundary="94eb2c0b92ace374b5054057c68d"
Archived-At: <>
Cc: Nat Sakimura via Openid-specs-fapi <>, OAuth WG <>
Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 02 Nov 2016 21:03:49 -0000

On Sun, Oct 30, 2016 at 9:27 AM, Samuel Erdtman <> wrote:

> I agree it is written so that the connection to the certificate is
> implicitly required but I think it would be better if it was explicit
> written since the lack of a connection would result in a potential security
> hole.

That's fair. I agree it can be made more explicit and that it be good to do

> When it comes to the client_id I think subject common name or maybe
> subject serial numbers will be the common location, and I think an example
> would be valuable.

In my experience and the way we built support for mutual TLS OAuth client
auth the client_id value does not appear in the certificate anywhere. I'm
not saying it can't happen but don't think it's particularly common.

I can look at adding some examples, if there's some consensus that they'd
be useful and this document moves forward.

> I´m not saying it is a bad Idea just that I would prefer if it was not a
> With very limited addition of code it is just as easy to get the
> certificate attribute for client id as it is to get it from the HTTP
> request data (at least in java). I also think that with the requirement to
> match the incoming certificate in some way one has to read out the
> certificate that was used to establish the connection to do some kind of
> matching.
Getting data out of the certificate isn't a concern. I just believe that
the constancy of having the client id parameter is worth the potential
small amount duplicate data in some cases. It's just a -00 draft though and
if the WG wants to proceed with this document, we seek further input and
work towards some consensus.