Re: [OAUTH-WG] Fwd: New Version Notification for draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt

Takahiko Kawasaki <taka@authlete.com> Mon, 02 November 2020 20:34 UTC

Return-Path: <taka@authlete.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 148D03A11EA for <oauth@ietfa.amsl.com>; Mon, 2 Nov 2020 12:34:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.895
X-Spam-Level:
X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_FONT_FACE_BAD=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=authlete-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wdz_SCYIGAXc for <oauth@ietfa.amsl.com>; Mon, 2 Nov 2020 12:34:38 -0800 (PST)
Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C6B223A11E9 for <oauth@ietf.org>; Mon, 2 Nov 2020 12:34:37 -0800 (PST)
Received: by mail-wr1-x430.google.com with SMTP id x7so16141170wrl.3 for <oauth@ietf.org>; Mon, 02 Nov 2020 12:34:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=authlete-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=D5jojqimb0iuH4EEi4ITR/fRL7gj40b3GrgMSrsHHhY=; b=yItB5BavK7R1d95z8zBDide8+Vzne5JvKxQzElT1v746eznTDKTFrn3cX3GPSjZWnW RSrOXLqVKlGgpqsA2+VoElOlRHkv3oSfk+rmQ2EbV9mDdme3ef+jWg508ATqrFtOoEQV T17TOUcSCrwqw1vOWZKIfXKK7+KHFpuuWAYN/ZRtK6sPCoeEcyvJkmy311d+oa4HV5KW ve/HGO1NifpEOyk5AeO/x6fONqInaPwqoRDn6H5980ABmrgzdEf530McINPOpwuofAQa qEArWgDj9ylIIyVnvHQZbjPv0CvenPVnG7xc/ak47EdY96lO4HRgv0uJ0apJF362Mc67 f52A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=D5jojqimb0iuH4EEi4ITR/fRL7gj40b3GrgMSrsHHhY=; b=MKS/NlLrmaamWYmhMD9zQSFCmCuuTigVDkPurK6dOFISaL0WWRJK7PS4YmRqB2NOYs LcSaoPl2k/yKJL/aKPJiT/HGKVXQmElus6bd58YCt0QKmsghkyPcrh4LhhV0coWkQoWo xWDHBOvza+P8cC605hKejk26Repftn4kjl+tmKS6GYFujIzy6JNB8jUHCzEIzAoK0N9e WrV/l5R56MK+qYR6GDGkRJJ7q9EoOp8GfthqvOAYOUWAM2+J/Qzt4IV98Lla90XfDJaO ojNQla2IL3WZpb1X0X5m6tZ1ihIvx4/0gkPFqFudFStnaUl7nPLH/8XAmGT7Z/z6NlMq clrA==
X-Gm-Message-State: AOAM5315V9Z5stxzu1oTc0g423w1DerkxVRpyjQSkOBQq8NTpNDx2t1V qWywfRZk0c1GNo2EWUBHNeDpy1k7AJu0HEHl84yTo7RDpfo=
X-Google-Smtp-Source: ABdhPJwbBIWCVee2FbWFXTs+e6DVoPlEL7LMt7A2EVESQqesSe1QB4LElBTqzy1YkbUtfTSnY/QFyYYEFoeKhr1Mu78=
X-Received: by 2002:adf:e384:: with SMTP id e4mr22327729wrm.227.1604349275596; Mon, 02 Nov 2020 12:34:35 -0800 (PST)
MIME-Version: 1.0
References: <160430230298.9780.18195581822860811409@ietfa.amsl.com> <fc75c5d7-49b2-7760-c98a-8dd6ca3d09eb@hackmanit.de> <6f382f32-31ae-9907-4fd0-a88d5ae978bb@connect2id.com>
In-Reply-To: <6f382f32-31ae-9907-4fd0-a88d5ae978bb@connect2id.com>
From: Takahiko Kawasaki <taka@authlete.com>
Date: Tue, 3 Nov 2020 05:34:37 +0900
Message-ID: <CAHdPCmNMTse_VJ4moYpeS+CCxrEDZTMcRL-dbNWUU_wPmMcZyw@mail.gmail.com>
To: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000aafc3b05b325ac6b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Ut0gqNul5kvQWKSFgYZeakFXNSU>
Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Nov 2020 20:34:40 -0000

Hi Karsten,

The specification mentions JARM. Does this specification require the iss
response parameter even when JARM is used? That is, should an authorization
response look like below?

HTTP/1.1 302 Found
Location: https://client.example.com/cb?response={JWT}&iss={ISSUER}

Or, can the iss response parameter be omitted when JARM is used?

A small feedback for the 3rd paragraph in Section 4: s/identifes/identifies/

Best Regards,
Taka


On Tue, Nov 3, 2020 at 3:13 AM Vladimir Dzhuvinov <vladimir@connect2id.com>
wrote:

> Thanks Karsten, looks good to me now, no further comments.
>
> Vladimir
> On 02/11/2020 09:54, Karsten Meyer zu Selhausen wrote:
>
> Hi all,
>
> Daniel and I published a new version of the "iss" response parameter draft
> to address the feedback from the WG.
>
> Changes in -01:
>
>    - Incorporated first WG feedback
>    - Clarifications for use with OIDC
>    - Added note that clients supporting just one AS are not vulnerable
>    - Renamed metadata parameter
>    - Various editorial changes
>
>
> We would like to ask you for further feedback and comments on the new
> draft version.
>
> Best regards,
> Karsten
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
> Date: Sun, 01 Nov 2020 23:31:42 -0800
> From: internet-drafts@ietf.org
> To: Karsten Meyer zu Selhausen <karsten.meyerzuselhausen@hackmanit.de>
> <karsten.meyerzuselhausen@hackmanit.de>de>, Karsten zu Selhausen
> <karsten.meyerzuselhausen@hackmanit.de>
> <karsten.meyerzuselhausen@hackmanit.de>de>, Daniel Fett <mail@danielfett.de>
> <mail@danielfett.de>
>
>
> A new version of I-D, draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
> has been successfully submitted by Karsten Meyer zu Selhausen and posted
> to the
> IETF repository.
>
> Name: draft-meyerzuselhausen-oauth-iss-auth-resp
> Revision: 01
> Title: OAuth 2.0 Authorization Server Issuer Identifier in Authorization
> Response
> Document date: 2020-11-01
> Group: Individual Submission
> Pages: 10
> URL:
> https://www.ietf.org/archive/id/draft-meyerzuselhausen-oauth-iss-auth-resp-01.txt
> Status:
> https://datatracker.ietf.org/doc/draft-meyerzuselhausen-oauth-iss-auth-resp/
> Html:
> https://www.ietf.org/archive/id/draft-meyerzuselhausen-oauth-iss-auth-resp-01.html
> Htmlized:
> https://tools.ietf.org/html/draft-meyerzuselhausen-oauth-iss-auth-resp-01
> Diff:
> https://www.ietf.org/rfcdiff?url2=draft-meyerzuselhausen-oauth-iss-auth-resp-01
>
> Abstract:
> This document specifies a new parameter "iss" that is used to
> explicitly include the issuer identifier of the authorization server
> in the authorization response of an OAuth authorization flow. If
> implemented correctly, the "iss" parameter serves as an effective
> countermeasure to "mix-up attacks".
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
> --
> Karsten Meyer zu Selhausen
> IT Security Consultant
> Phone:	+49 (0)234 / 54456499
> Web:	https://hackmanit.de | IT Security Consulting, Penetration Testing, Security Training
>
> Does your OAuth or OpenID Connect implementation use PKCE to strengthen the security? Learn more about the procetion PKCE provides and its limitations in our new blog post:https://www.hackmanit.de/en/blog-en/123-when-pkce-cannot-protect-your-confidential-oauth-client
>
> Hackmanit GmbH
> Universitätsstraße 60 (Exzenterhaus)
> 44789 Bochum
>
> Registergericht: Amtsgericht Bochum, HRB 14896
> Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Dr. Marcus Niemietz
>
>
> _______________________________________________
> OAuth mailing listOAuth@ietf.orghttps://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>