Re: [OAUTH-WG] Auth Server / Resource Server Coordination

[Vladimir Dzhuvinov <[e-mail]>]

On 13.10.2015 07:37, Ofer Nave wrote:
>> You do have decisions to make on whether you use symmetric crypto or PK
> there.
>
> That's another thing I was pondering -- simple shared secret, or require
> generated a private/public key pair.
>
> The asymetric form is a little more complicated in terms of the user
> experience.  Is there a practical reason to prefer it?

If the AS and the Resource Servers (RS) share a secret, there is a risk
of an RS impersonating authorised clients by creating valid tokens to
access other RSs.

You may prevent this by making sure every RS gets its own secret, but in
that case you cannot issue tokens with multiple RS audiences.

With asymmetric keys you won't have these problems. The RS would only
need to have a copy of the public AS key to verify the tokens.


Vladimir

-- 
Vladimir Dzhuvinov