Re: [OAUTH-WG] OAuth WRAP

[Peter Saint-Andre <[e-mail]>]

On 11/11/09 7:38 AM, John Panzer wrote:
> To clarify the distinctions between OAuth WRAP and OAuth 1.0a, the OAuth
> WRAP doc[1] Appendix C states the following:
> 
> "OAuth WRAP    requires        the     Authorization   Server  to    
>  support HTTPS,  OAuth   1.0A    does    not."

It's not clear to me that this distinction would force someone to define
or label a new protocol. For instance in XMPP the protocol requires
support for TLS in *implementations*, but leaves the use of TLS by any
one *deployment* up to local service policy.

> This is an important distinction, though I assume it applies only to the
> profile(s) supplied as part of WRAP and not to extension profile(s) that
> may be created.  E.g., one could create a fourth profile which did not
> require HTTPs -- it just would not be as interoperable as the others,
> and servers and clients are not required to support it, but it would be
> otherwise compatible with WRAP if I understand correctly.)
> 
> "The   Access  Token   in      OAuth   WRAP    is      opaque  to    
>  the     Client. 

Isn't the token always opaque to the client? What semantic information
should we expect a client to clean from an access token?

> The     Client  does    not     need    to      perform
> any     cryptography    except  for     calling HTTPS."

A security review would tell us if that assumption is warranted. And,
again, this seems to be more of a deployment choice (the client and
server require SSL/TLS and therefore feel safe in using PLAINTEXT) than
a protocol change.

> This is also important, but what is the difference between WRAP and
> OAuth 1.0A PLAINTEXT mode?  They seem to be pretty much identical to me,
> if there is a difference it should be called out.

Agreed.

> "The   Access  Token   in      OAuth   WRAP    can     contain
> authorization   information,    or      claims, enabling        the    
> Protected     Resource        to      determine       the     Client's  
>      authorization   without querying        any     other   resource."
> 
> I don't understand this distinction; this sounds exactly like the OAuth
> 1.0a token.  What am I missing?

Yes, this sounds very similar.

/psa