Re: [OAUTH-WG] FW: I-D Action: draft-ietf-oauth-jwsreq-13.txt

John Bradley <ve7jtb@ve7jtb.com> Fri, 31 March 2017 00:05 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03F4812869B for <oauth@ietfa.amsl.com>; Thu, 30 Mar 2017 17:05:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2ZKb-W1rNXmQ for <oauth@ietfa.amsl.com>; Thu, 30 Mar 2017 17:05:15 -0700 (PDT)
Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 61A83129648 for <oauth@ietf.org>; Thu, 30 Mar 2017 17:05:13 -0700 (PDT)
Received: by mail-io0-x233.google.com with SMTP id b140so30284231iof.1 for <oauth@ietf.org>; Thu, 30 Mar 2017 17:05:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=egy18EATFe4BYdcGNs0xNfKcRzCYjtRE4qOpUBF/vmA=; b=pI70F4Tp/iReHH0BkAuzqycGRbi9XCQodQqoPErXGhDj9xArNk/3hu9Y9fCv5lymaz Yl2mg5C52g/O0HyEt0cPt5SshGYl9Vt0/rbsTUd2x/Wp4V50raaK9H20RkN1wD2NoUdY cQQhC1xD6S9uokwtjEZw4jxLov1HC9rRiOcZ0ZDs05UJoTsRHIod7CmKZG6ieEeydxjm DGqQJKpRV9XS7m3BibMfKUbz9ZIGxNqKqxj64+/Z4CGZ8l4/FKj0jNDIYSczlSu0NyZd 9OgjYCtYU0F6xUSkeaYvKTG66mggVvBZml0IyW+rG9PID+5ktRhEuHrHzJm7LMOBgWav I0qQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=egy18EATFe4BYdcGNs0xNfKcRzCYjtRE4qOpUBF/vmA=; b=SvS/udbpU2LthqMzgfjtfktOmJZic9IunR8naCMfVzo9lvzLJ7FX7wG8MCU+ht8pM6 OCBA0M5Tsdk6loMF+HXw7b8jfQCb4y+bHD2soUI+C7Be3wTV/O99heVYPxOEPaAvOFUX m0qrdlR9R/2lJWwx1EF+fFR2CGUVW/mU89fRfRqUhsitakRrnH8Xrd2XV/kk1WhTIrmy eMiM9IDu16IjJU9JkiRx6qAg0hypm6M/IuUheZ4yBvbWqR8vZqb9JyDribhmX7sqHciF igv3wY0oRzScJCrPmy+tcX+sBtvOqgrJQ8quzQDnWm+bBDpxZ/oa8W5kwvSHjIEXlv6p gVpw==
X-Gm-Message-State: AFeK/H1FZ/dOPAzlgT0V4Xz3smlXTGnJ0/eZbpot2j1F/UVnsF7ZumvTB0N/bfJ6aOe67c5XD55/1PCV4rfKSbKJ
X-Received: by 10.107.135.136 with SMTP id r8mr241168ioi.36.1490918712473; Thu, 30 Mar 2017 17:05:12 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.167.139 with HTTP; Thu, 30 Mar 2017 17:05:12 -0700 (PDT)
Received: by 10.107.167.139 with HTTP; Thu, 30 Mar 2017 17:05:12 -0700 (PDT)
In-Reply-To: <0b598482-d9d1-4a8f-8616-b19d1a3b3084@typeapp.com>
References: <149089911092.15436.12952695214868679547@ietfa.amsl.com> <58dd63ca.e7136b0a.5e8ec.8d9e@mx.google.com> <CY4PR21MB05049EB2094DF00A482CA03EF5340@CY4PR21MB0504.namprd21.prod.outlook.com> <CAANoGhLvwSrNTcA6+gXvkVPVoDwu3QHFoTsOfwV2BynVGQsk1A@mail.gmail.com> <CY4PR21MB050463909C8401C981362218F5340@CY4PR21MB0504.namprd21.prod.outlook.com> <0b598482-d9d1-4a8f-8616-b19d1a3b3084@typeapp.com>
From: John Bradley <ve7jtb@ve7jtb.com>
Date: Thu, 30 Mar 2017 19:05:12 -0500
Message-ID: <CAANoGhJDKgqWaqhdL6TCO7RhE==h=ZmJeKbU-cuwUZwE+siHMA@mail.gmail.com>
To: Nat Sakimura <nat@sakimura.org>
Cc: Mike Jones <Michael.Jones@microsoft.com>, IETF oauth WG <oauth@ietf.org>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="001a113ec77c441905054bfb90b6"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/_1eDbE-QW0xm8trYX0YNBg8utRM>
Subject: Re: [OAUTH-WG] FW: I-D Action: draft-ietf-oauth-jwsreq-13.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 31 Mar 2017 00:05:19 -0000

So I think we need to make the must ignore clearer for the additional
paramaters on the authorization endpoint.

On Mar 30, 2017 17:33, "Nat Sakimura" <nat@sakimura.org> wrote:

> Not right now.
>
> As of this writing, a client can still send duplicate parameters in the
> query but they get ignored by the servers honoring OAuth JAR. So, it is
> backwards compatible with OpenID Connect in that sense (OpenID Connect
> sends duplicate manatory RFC6749 parameters as the query parameters as well
> just to be compliant to RFC6749). Conversely, servers that do not support
> OAuth JAR will ignore request_uri etc.
> On Mar 30, 2017, at 4:47 PM, Mike Jones <Michael.Jones@microsoft.com>
> wrote:
>>
>> Is there a clear statement somewhere along the lines of “parameters
>> (other than “request” or “request_uri”) are only allowed to be in the
>> signed object if a signed object is used”?  That’s the kind of thing I
>> was looking for and didn’t find.
>>
>>
>>
>>                                                        -- Mike
>>
>> *From:* John Bradley [mailto:ve7jtb@ve7jtb.com]
>> *Sent:* Thursday, March 30, 2017 4:44 PM
>> *To:* Mike Jones <Michael.Jones@microsoft.com>
>> *Cc:* Nat Sakimura <nat@sakimura.org>rg>; IETF oauth WG <oauth@ietf.org>
>> *Subject:* RE: [OAUTH-WG] FW: I-D Action: draft-ietf-oauth-jwsreq-13.txt
>>
>>
>>
>> The intent of the change is to only allow the paramaters to be in the
>> signed object if a signed object is used.
>>
>>
>>
>> This requires State, nonce etc to be in the JWT.  Only one place to check
>> will hopefully reduce implimentation errors.
>>
>>
>>
>> This also allows us to remove the caching text as we now have one JWT per
>> request, so caching won't happen.
>>
>>
>>
>> John B.
>>
>>
>>
>>
>>
>>
>>
>> On Mar 30, 2017 4:36 PM, "Mike Jones" <Michael.Jones@microsoft.com>
>> wrote:
>>
>> I **believe** the intent is that **all** parameters must be in the
>> request object, but the spec doesn’t actually say that, as far as I can
>> tell.  Or maybe the intent is that parameters must not be duplicated
>> between the query parameters and the request object.
>>
>>
>>
>> One or the other of these statements should be explicitly included in the
>> specification.  Of course, I could have missed the statement I’m asking for
>> in my review, in which case please let me know what I missed.
>>
>>
>>
>>                                                        Thanks,
>>
>>                                                       -- Mike
>>
>>
>>
>> *From:* OAuth [mailto:oauth-bounces@ietf.org] *On Behalf Of *John Bradley
>> *Sent:* Thursday, March 30, 2017 3:00 PM
>> *To:* IETF OAUTH <oauth@ietf.org>
>> *Subject:* [OAUTH-WG] FW: I-D Action: draft-ietf-oauth-jwsreq-13.txt
>>
>>
>>
>> Based on feeback from the IESG we have removed some of the optionality in
>> the draft.
>>
>>
>>
>> It is a shorter read than draft 12.
>>
>>
>>
>> John B.
>>
>>
>>
>> Sent from Mail <https://go.microsoft.com/fwlink/?LinkId=550986> for
>> Windows 10
>>
>>
>>
>> *From: *internet-drafts@ietf.org
>> *Sent: *March 30, 2017 1:38 PM
>> *To: *i-d-announce@ietf.org
>> *Cc: *oauth@ietf.org
>> *Subject: *[OAUTH-WG] I-D Action: draft-ietf-oauth-jwsreq-13.txt
>>
>>
>>
>>
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>>
>> This draft is a work item of the Web Authorization Protocol of the IETF.
>>
>>
>>
>>         Title           : The OAuth 2.0 Authorization Framework: JWT
>> Secured Authorization Request (JAR)
>>
>>         Authors         : Nat Sakimura
>>
>>                           John Bradley
>>
>>            Filename        : draft-ietf-oauth-jwsreq-13.txt
>>
>>            Pages           : 27
>>
>>            Date            : 2017-03-30
>>
>>
>>
>> Abstract:
>>
>>    The authorization request in OAuth 2.0 described in RFC 6749 utilizes
>>
>>    query parameter serialization, which means that Authorization Request
>>
>>    parameters are encoded in the URI of the request and sent through
>>
>>   user agents such as web browsers.  While it is easy to implement, it
>>
>>    means that (a) the communication through the user agents are not
>>
>>    integrity protected and thus the parameters can be tainted, and (b)
>>
>>    the source of the communication is not authenticated.  Because of
>>
>>    these weaknesses, several attacks to the protocol have now been put
>>
>>    forward.
>>
>>
>>
>>    This document introduces the ability to send request parameters in a
>>
>>    JSON Web Token (JWT) instead, which allows the request to be signed
>>
>>    with JSON Web Signature (JWS) and/or encrypted with JSON Web
>>
>>    Encryption (JWE) so that the integrity, source authentication and
>>
>>    confidentiality property of the Authorization Request is attained.
>>
>>    The request can be sent by value or by reference.
>>
>>
>>
>>
>>
>> The IETF datatracker status page for this draft is:
>>
>> https://datatracker.ietf.org/doc/draft-ietf-oauth-jwsreq/
>>
>>
>>
>> There are also htmlized versions available at:
>>
>> https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-13
>>
>> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-jwsreq-13
>>
>>
>>
>> A diff from the previous version is available at:
>>
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-jwsreq-13
>>
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>>
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>>
>>
>> Internet-Drafts are also available by anonymous FTP at:
>>
>> ftp://ftp.ietf.org/internet-drafts/
>>
>>
>>
>> _______________________________________________
>>
>> OAuth mailing list
>>
>> OAuth@ietf.org
>>
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>>
>>
>>