[OAUTH-WG] JWT profile and IdentityServer

Dominick Baier <dbaier@leastprivilege.com> Mon, 04 May 2020 07:36 UTC

Return-Path: <dbaier@leastprivilege.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id BA79B3A0D1F for <oauth@ietfa.amsl.com>; Mon, 4 May 2020 00:36:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=leastprivilege-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id bjo2s5kGRxpF for <oauth@ietfa.amsl.com>; Mon, 4 May 2020 00:36:49 -0700 (PDT)
Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29A583A0D1E for <oauth@ietf.org>; Mon, 4 May 2020 00:36:48 -0700 (PDT)
Received: by mail-qk1-x72a.google.com with SMTP id b188so15629574qkd.9 for <oauth@ietf.org>; Mon, 04 May 2020 00:36:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=leastprivilege-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:date:message-id:subject:to; bh=Jg75dROtWgyWOZlQ6FKCQof9SLCUskha8eUAEJwUBnY=; b=oMyaQJYgCy6wkUJHot5FOU4YXC3JQc7mlSFVNLkPYUl939KC/EW79dfDt6gypa6oHw Jj2nXym4qQX9prRLVGkGTHfhPSvnq4UP7lssvYWtcFm+8+eyppVaeK2Kyobgk7C70HCs zDTcktptNPZziUdPBgKYUtqnu2GiyrwbCZFvPA4mPPVdF7q/1BoChjgAN73XamNwAYQV SAl4htCbUGBLJ1sqdX7bYnMcKeBMhcKLK8rLI4dfpsYI3Ab4iC8eHsv0fPcONdd7eMp6 ngeYKh/dSUgVdxpeFdQYdCy+XszlErqObxZZRlhVunj8wam7JtFyZwCdP3Lkgn0ZnWB4 Eadg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:date:message-id:subject:to; bh=Jg75dROtWgyWOZlQ6FKCQof9SLCUskha8eUAEJwUBnY=; b=cH3MdE8ZBm6BCHxVHcfYjOTmElisq/dfPdfUDdZ7HnVX9Ib6/BR024cIxorJrQQjFO 5LswVW0oE1iA+0/6rJqifN6eWlYiMxuWT2eplnFXVkqYaaLhdxf2c7QIgu6D6M2NrprF 8jhcsy2wp10sNGvKFGK78jntGi/Lt1r7LbA3ojJghmJVdc4wG0w34MSJWe90c3Pw9uTs za9APs06SR9EorsLqBOiw02TFszkXQwcCksRpfCfEKPtW2I2VNRrB/Yg/Trd3MZ8Q7Gh yGqWH9w0Pd9317WhNVSs2ibIYjfOPoUOHTUgH7KSHP0jxhwlLlFFfNQWCHA4tAGeWDk+ nUkQ==
X-Gm-Message-State: AGi0PubFZ69ywsqt7PAOo7Vl6+aNdgPqyvvVPaygOEwoLCTPpJGBXMfY zRm/MfV3uHGAsd/nDwQAGGnD2mgXw5KWle4r68zlduo=
X-Google-Smtp-Source: APiQypIPpCW7FUPwrdketC07F5Tcmp6J2XYWK/TcXd0j6dCgD68zk9W/BxB4k2VC/xC3Lb4b16hB/+e03Na5h3Z5u78=
X-Received: by 2002:a05:620a:85d:: with SMTP id u29mr8152949qku.496.1588577807532; Mon, 04 May 2020 00:36:47 -0700 (PDT)
Received: from 1058052472880 named unknown by gmailapi.google.com with HTTPREST; Mon, 4 May 2020 03:36:46 -0400
From: Dominick Baier <dbaier@leastprivilege.com>
MIME-Version: 1.0
Date: Mon, 4 May 2020 03:36:46 -0400
Message-ID: <CAO7Ng+vZNsrVb1-Di+7g8_YMXbgns78TaE8uOUR=jX27pbJAoQ@mail.gmail.com>
To: oauth@ietf.org, vittorio.bertocci@auth0.com
Content-Type: multipart/alternative; boundary="000000000000ea9d4205a4cd9715"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/UWa9Z1MQ2devFem8mhlfiFIjLWA>
Subject: [OAUTH-WG] JWT profile and IdentityServer
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 04 May 2020 07:36:51 -0000


Just some notes on applying the JWT profile to IdentityServer

* we emit the at+jwt typ - that’s very useful
* we emit iat in addition to nbf (if we would remove nbf, we would break
the .NET JWT library from Microsoft - I guess that’s the reason AAD emits
it as well)
* we have an option to emit scope as a space delimited string (we used a
string array for historic reasons - also because that’s how the claims
plumbing in .NET prefers it)

* aud

Audience is optional in IdentityServer if you request scopes that do not
have an association to a resource. I personally think this is the right way
to go. You can “force” an audience even for this situation if you
absolutely want to

* sub vs client_id

In IdentityServer access tokens that do not have a user present, do not
have a sub claim - only client_id. If there is a user present, sub ALWAYS
represents the user.

I was prototyping a setting to emit the sub claim for situation where there
is no user, which would not be hard to do - but we found out that there are
many situations where this would need VERY THOROUGH testing of all the
various flows to not introduce subtle security bugs

* the user info endpoint needs to do extra checking
* extension grants that did not use to present users
* token exchange scenarios
* enforce a collision domain for sub and client_id

This could all be sorted probably if I would have enough time right now -
but the bottom line is, that this ambiguity and special casing requires
careful re-writing and I guess this applies to any reasonably complex
system that is already out there. So I am still not sold that the “dual
purpose” claims are the best choice. YMMV.

IOW - we will not adopt the sub/client_id semantics as proposed by the

My 2c / cheers
Dominick Baier