Re: [OAUTH-WG] question about the b64token syntax in draft-ietf-oauth-v2-bearer

Mike Jones <Michael.Jones@microsoft.com> Tue, 06 March 2012 01:34 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 152F321E8027 for <oauth@ietfa.amsl.com>; Mon, 5 Mar 2012 17:34:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.765
X-Spam-Level:
X-Spam-Status: No, score=-3.765 tagged_above=-999 required=5 tests=[AWL=-0.166, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id swwfrXug5pvI for <oauth@ietfa.amsl.com>; Mon, 5 Mar 2012 17:34:01 -0800 (PST)
Received: from ch1outboundpool.messaging.microsoft.com (ch1ehsobe003.messaging.microsoft.com [216.32.181.183]) by ietfa.amsl.com (Postfix) with ESMTP id 38B6521E8012 for <oauth@ietf.org>; Mon, 5 Mar 2012 17:34:01 -0800 (PST)
Received: from mail86-ch1-R.bigfish.com (10.43.68.235) by CH1EHSOBE014.bigfish.com (10.43.70.64) with Microsoft SMTP Server id 14.1.225.23; Tue, 6 Mar 2012 01:34:00 +0000
Received: from mail86-ch1 (localhost [127.0.0.1]) by mail86-ch1-R.bigfish.com (Postfix) with ESMTP id 4F9291C0209; Tue, 6 Mar 2012 01:34:00 +0000 (UTC)
X-SpamScore: -32
X-BigFish: VS-32(zz9371I542M1432Nzz1202hzz1033IL8275dhz2fh2a8h668h839h)
X-Forefront-Antispam-Report: CIP:131.107.125.8; KIP:(null); UIP:(null); IPV:NLI; H:TK5EX14MLTC101.redmond.corp.microsoft.com; RD:none; EFVD:NLI
Received-SPF: pass (mail86-ch1: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14MLTC101.redmond.corp.microsoft.com ; icrosoft.com ;
Received: from mail86-ch1 (localhost.localdomain [127.0.0.1]) by mail86-ch1 (MessageSwitch) id 1330997637500548_25134; Tue, 6 Mar 2012 01:33:57 +0000 (UTC)
Received: from CH1EHSMHS011.bigfish.com (snatpool1.int.messaging.microsoft.com [10.43.68.251]) by mail86-ch1.bigfish.com (Postfix) with ESMTP id 6AB872000DC; Tue, 6 Mar 2012 01:33:57 +0000 (UTC)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (131.107.125.8) by CH1EHSMHS011.bigfish.com (10.43.70.11) with Microsoft SMTP Server (TLS) id 14.1.225.23; Tue, 6 Mar 2012 01:33:57 +0000
Received: from TK5EX14MBXC283.redmond.corp.microsoft.com ([169.254.2.124]) by TK5EX14MLTC101.redmond.corp.microsoft.com ([157.54.79.178]) with mapi id 14.02.0283.004; Tue, 6 Mar 2012 01:32:59 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: "Manger, James H" <James.H.Manger@team.telstra.com>, Brian Campbell <bcampbell@pingidentity.com>, oauth <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] question about the b64token syntax in draft-ietf-oauth-v2-bearer
Thread-Index: AQHM+yhkmuwCbxmTb0mjcYxusRGRDJZcezXg
Date: Tue, 6 Mar 2012 01:32:58 +0000
Message-ID: <4E1F6AAD24975D4BA5B1680429673943663DB078@TK5EX14MBXC283.redmond.corp.microsoft.com>
References: <CA+k3eCTTsqJZ7XzjA1qgxEJcyU0uio5EN2=yvs+h6ja1JEymiQ@mail.gmail.com> <255B9BB34FB7D647A506DC292726F6E114EDF66EE8@WSMSG3153V.srv.dir.telstra.com>
In-Reply-To: <255B9BB34FB7D647A506DC292726F6E114EDF66EE8@WSMSG3153V.srv.dir.telstra.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.72]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
Subject: Re: [OAUTH-WG] question about the b64token syntax in draft-ietf-oauth-v2-bearer
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Mar 2012 01:34:02 -0000

I'm fine with changing the example to make it clearer that b64token allows a wider range of characters than just those legal for base64 and base64url encodings of data values.

I'll add it to my to-do list for any additional edits for the Bearer spec.

				-- Mike

-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Manger, James H
Sent: Monday, March 05, 2012 3:33 PM
To: Brian Campbell; oauth
Subject: Re: [OAUTH-WG] question about the b64token syntax in draft-ietf-oauth-v2-bearer

Brian,

> On casual reading of "The OAuth 2.0 Authorization Protocol: Bearer
> Tokens"* I've encountered several people (including myself) who have 
> made the assumption that the name b64token implies that some kind of
> base64 encoding/decoding on the access token is taking place between 
> the client and RS.
> 
> Digging a bit deeper in to "HTTP/1.1, part 7: Authentication"**, 
> however, I see that b64token is just an ABNF syntax definition 
> allowing for characters typically used in base64, base64url, etc.. So 
> the b64token doesn't define any encoding or decoding but rather just 
> defines what characters can be used in the part of the Authorization 
> header that will contain the access token.
>
> Do I read this correctly?

Yes.

> If so, I feel like some additional clarifying text in the Bearer 
> Tokens draft might help avoid what is (based on my small sample) a 
> common point of misunderstanding.

Changing the example bearer token should be a simple way to avoid some confusion by showing that it does not have to be base64 encoding. How about changing:
  Authorization: Bearer vF9dft4qmT
to
  Authorization: Bearer vF9.dft4.qmT

The Bearer spec has lots of (unnecessary) text about OAuth, but doesn't quite manage to be precise about how OAuth and Bearer connect. It could explicitly state that the string value of the "access_token" member of an access token response is the bearer token. The "access_token" string value (after unescaping any JSON-escapes) MUST match the b64token ABNF so it can be used with the Bearer HTTP scheme. Such text could be put in §5.1.1 where the "Bearer" OAuth access token type is defined.


> Also, does the use of b64token implicitly limit the allowed characters 
> that an AS can use to construct a bearer access token?

Yes.


> * http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-17#section-2.1
> ** 
> http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-18#section-2.1

--
James Manger
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth