IETF Logo Mail Archive

Re: [OAUTH-WG] Listing OAuth Access Token Metadata

Takahiko Kawasaki <taka@authlete.com> Sun, 03 April 2022 17:55 UTC

Return-Path: <taka@authlete.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 693863A1CBB for <oauth@ietfa.amsl.com>; Sun, 3 Apr 2022 10:55:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.905
X-Spam-Level:
X-Spam-Status: No, score=-1.905 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=authlete-com.20210112.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 46zte5DQKPam for <oauth@ietfa.amsl.com>; Sun, 3 Apr 2022 10:55:26 -0700 (PDT)
Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DE093A1ACA for <OAuth@ietf.org>; Sun, 3 Apr 2022 10:55:26 -0700 (PDT)
Received: by mail-wm1-x329.google.com with SMTP id c190-20020a1c35c7000000b0038e37907b5bso6412260wma.0 for <OAuth@ietf.org>; Sun, 03 Apr 2022 10:55:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=authlete-com.20210112.gappssmtp.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sEV89u/9jtw+CIFFLZi6IqdSvXNKFNbfT/wSnSMJqPA=; b=DzBRrB6pWTgUcFtMi3bC8OgJ8jIDU+KkbBO2jB4tQ7PvQoRz1y1cihcjTYtyZjXtzF CN2E9YIwtKFKYT6GUWwoYsu2SVR0t8cUsy0/ciop2b9nL8kKcm/1dlHPd2i7qqbQLngu MKoTtzd3hYC+hU08uXCExjYuLa3rEnsI/Lrk5zg+hyE2frkij0QridluZ2hXGUeTN9bg tpgfz5HZkxIrfCUZadEYLTE4IoYb0pZVt8uDngki02D4q4Bsj9xNATjpQxbghzuTHu/m zzvB63cOVCkcV0iiykmTK+rcwnz/IAX273igOkvQBeY2GckuFBZkCuJI2CoDjZSKB5mE G3aQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sEV89u/9jtw+CIFFLZi6IqdSvXNKFNbfT/wSnSMJqPA=; b=fBhfLeVslBQyh+V72YXigS2YOAIZp0+d26QXsG24htmavaVKJuVGtF+RRSrUQCaTdw U7i5d2tsxLeopK1zXB8IvMA4QN8mNKPdN2H2u6IseuMqoEzhD67T3UxA6GSbuQT3z5oR oKSRTCpFHUhB5k/xS0p95eJA5m/PVbq9zxNiyPvGcQzXZj0MACD0MSHEMAZC3F620F6L 8+1d0qz0uGRD/SjrEkjArFriPMUEkHt3USUYBC6CMiEAqj6qoTifsCEOyxUTIljAUqIk bP+jQ76FHfIA4NlB92CCJlL7w8jvZWrRWR1TMspxQ+HvDlG/SL7M5hcP/LlZIA2sumlG iF/g==
X-Gm-Message-State: AOAM533znGwV4Z7b1ARU5MK+m+3J2jXGps9nIMPfnlkg5J58lDwmJfeb Qunz3P1M8X+C2f9rI+Qa9GFvd4glcE/MxGAFxMFINmQpRa0=
X-Google-Smtp-Source: ABdhPJzrghhxSaisVm6vGgGganP9QbkYMy65Fr6nXdqykyUnrzmqw/+6MuBTd3XrtxAY0SOkRVCGzq1iJvPqz/DBD/I=
X-Received: by 2002:a05:600c:3ca4:b0:38e:54d0:406d with SMTP id bg36-20020a05600c3ca400b0038e54d0406dmr11169714wmb.199.1649008524220; Sun, 03 Apr 2022 10:55:24 -0700 (PDT)
MIME-Version: 1.0
References: <CAL4nJSZSAEQQOy0dEwwD88Ne+vsQfTmj_RM7MPAFHnd18D7wMA@mail.gmail.com> <CF00B22F-0F92-4578-82DA-7EBF0208F4C6@alkaline-solutions.com>
In-Reply-To: <CF00B22F-0F92-4578-82DA-7EBF0208F4C6@alkaline-solutions.com>
From: Takahiko Kawasaki <taka@authlete.com>
Date: Mon, 04 Apr 2022 02:55:13 +0900
Message-ID: <CAHdPCmNx28rHgBaLtvRKWg9NyVbtJvA2DAs0aNHOoK5h8NvXdQ@mail.gmail.com>
To: Dhaura Pathirana <dhaurapathirana@gmail.com>
Cc: oauth <OAuth@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000051721d05dbc3b7f5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/UozBSBZYzZhuHODtz8x_eFohT74>
Subject: Re: [OAUTH-WG] Listing OAuth Access Token Metadata
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Apr 2022 17:55:33 -0000

Dear Dhaura,

My recommendation to you (undergraduate? LinkedIn says so) is to
investigate the following as the first step.


   - ID Token (OpenID Connect Core 1.0, Section 2)
   - UserInfo Endpoint (OpenID Connect Core 1.0, Section 5.3)


In general, inventing a new grant type should be the last resort.

Best Regards,
Takahiko Kawasaki


On Sun, Apr 3, 2022 at 3:35 PM David Waite <david=
40alkaline-solutions.com@dmarc.ietf.org> wrote:

>
> On Apr 1, 2022, at 3:24 AM, Dhaura Pathirana <dhaurapathirana@gmail.com>
> wrote:
>
> I would like to know if anyone has seen this (listing token metadata) as a
> common use case in OAuth2 and a standard way of doing it had been proposed
> before?
>
>
> OAuth Token Introspection (RFC 7662) defines a way to query for active
> state and meta-info.
>
> However, its use is defined only for protected resources, and not the
> resource owner or the client the token was issued to.
>
> -DW
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

v2.23.0 | Report a Bug | By Email