Re: [OAUTH-WG] About JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
vittorio.bertocci@auth0.com Fri, 02 April 2021 19:18 UTC
Return-Path: <vittorio.bertocci@auth0.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EA933A2040 for <oauth@ietfa.amsl.com>; Fri, 2 Apr 2021 12:18:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auth0.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wszeb_W21Odg for <oauth@ietfa.amsl.com>; Fri, 2 Apr 2021 12:18:13 -0700 (PDT)
Received: from mail-pf1-x436.google.com (mail-pf1-x436.google.com [IPv6:2607:f8b0:4864:20::436]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEB0E3A203E for <oauth@ietf.org>; Fri, 2 Apr 2021 12:18:13 -0700 (PDT)
Received: by mail-pf1-x436.google.com with SMTP id v10so4145620pfn.5 for <oauth@ietf.org>; Fri, 02 Apr 2021 12:18:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=auth0.com; s=google; h=from:to:references:in-reply-to:subject:date:message-id:mime-version :content-transfer-encoding:thread-index:content-language; bh=zD09ScUBub9iXtSBZKXC4M1i6J2x9y08PrYcxsJetCo=; b=XvlL+gPHdBWJHi7uDeLj5Zcq2jXH+i3NDaMeWc0Q03LbhVGve6uaF4vi2xYb/Cr8Io c+gG/Gy4sILWrJiTIhCmdf4vcCfyGUJQmTa1L3I6F3HjNAAGXc9gRFpMJ4AGg6qbP6TO gRP5rP9Qq6i0yiLNtaNEiGQ9nXDVDHr/w6RCGOIrcBbciYc53IUwfKmFwBgc0+81ZM3p mS4diFnSe6ZXzm2uauRFVA+BguSaKQKLG1wYUH02ZITmF6VSg6kBCVMsabTFxSHKd2Uv QJ7y5FQ841EwY9EqNSoDtwTjAiDnZ8LT9sANRr8bHPMNCp57GIRk9VcitpLMEdFq9D2y 7aZw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:references:in-reply-to:subject:date :message-id:mime-version:content-transfer-encoding:thread-index :content-language; bh=zD09ScUBub9iXtSBZKXC4M1i6J2x9y08PrYcxsJetCo=; b=B+G+Gp65kyIBVORy5gGG2MlkZtyT+WETLf+zEvc7g6jmi2zUDNi/LDZXUOi4vJl33z kB7dc1ZkMvBtqJOAKKBN2NfvTWjGDNeANwOa/VJTMrcDd8G2bwez3Mujawt+p1/Kql44 Z7bbwJmv7RlDgpt9F/+uVdERPT7vdz2s9Iaameo3dSybgtRADWrtU0/vaL4QKGpCQ2cS xUYsxBCf8MD+u2gS5N7Bl+0EYvxDKcAD9H8IU+hbF/fbQORXy4pLBQuUs9W0LKkQTMYC khOfi/huk8cnnvSxXp5VPVyI5V4RQm3whN7z5rqNIaBlqhZQgsRBwHQVHkl1OnO9s8Xh P9vQ==
X-Gm-Message-State: AOAM531F4448cxzkahl6S3PNS8LtHSteigE1GyoKep2lhpUub6ydUa3p ZR/Wlwf5b7CmIIfOr6co4xBRLK0Re+BXvw==
X-Google-Smtp-Source: ABdhPJwGycC4kpottcQwNMNwrsDDkrDL36r/EzbjDCOs1kGhtOwP+IAApLI9HVQ6DwWCHXKne20dAQ==
X-Received: by 2002:a63:e746:: with SMTP id j6mr12850547pgk.91.1617391092355; Fri, 02 Apr 2021 12:18:12 -0700 (PDT)
Received: from vibrosurface7 (c-67-171-8-60.hsd1.wa.comcast.net. [67.171.8.60]) by smtp.gmail.com with ESMTPSA id 22sm8793769pjl.31.2021.04.02.12.18.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Apr 2021 12:18:12 -0700 (PDT)
From: vittorio.bertocci@auth0.com
To: 'Nikos Fotiou' <fotiou@aueb.gr>, 'oauth' <oauth@ietf.org>
References: <42E6041E-9F06-4276-A3D0-63C7FE18A335@aueb.gr>
In-Reply-To: <42E6041E-9F06-4276-A3D0-63C7FE18A335@aueb.gr>
Date: Fri, 02 Apr 2021 12:18:10 -0700
Message-ID: <057901d727f4$ebae4850$c30ad8f0$@auth0.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQJDbSulm5vRZLDhbd+SAlQ8zqad/anJDd9g
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/VI_3S5g3AO24P9CQq46MBoJW7k4>
Subject: Re: [OAUTH-WG] About JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Apr 2021 19:18:18 -0000
Hi Nikos, Thanks for looking into this! The profile aims at reflecting currently adopted practice as much as it is viable, and the overwhelming majority of the use cases involving access tokens today relies on bearer tokens. Note: although there's no practical difference between versions in the matter you brought up here, in general I recommend referring to the latest draft: we are currently on version 12 (https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-12). -----Original Message----- From: OAuth <oauth-bounces@ietf.org> On Behalf Of Nikos Fotiou Sent: Thursday, April 1, 2021 12:11 PM To: oauth <oauth@ietf.org> Subject: [OAUTH-WG] About JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens Hi, By reading this draft (https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-05) I got the impression that it implies using JWTs as bearer tokens, e.g., it does consider any of the semantics defined in RFC7800. Is this correct? If yes what was the rational behind this design choice? Thanks a lot, Nikos -- Nikos Fotiou - http://pages.cs.aueb.gr/~fotiou Researcher - Mobile Multimedia Laboratory Athens University of Economics and Business https://mm.aueb.gr
- [OAUTH-WG] About JSON Web Token (JWT) Profile for… Nikos Fotiou
- Re: [OAUTH-WG] About JSON Web Token (JWT) Profile… vittorio.bertocci
- Re: [OAUTH-WG] About JSON Web Token (JWT) Profile… Thibault Normand