IETF Logo Mail Archive

Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint

Benjamin Kaduk <kaduk@mit.edu> Fri, 04 January 2019 21:55 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE85A130E8F for <oauth@ietfa.amsl.com>; Fri, 4 Jan 2019 13:55:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mit.edu
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9SlE8QWosBd0 for <oauth@ietfa.amsl.com>; Fri, 4 Jan 2019 13:55:48 -0800 (PST)
Received: from NAM04-SN1-obe.outbound.protection.outlook.com (mail-eopbgr700134.outbound.protection.outlook.com [40.107.70.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E2A71271FF for <oauth@ietf.org>; Fri, 4 Jan 2019 13:55:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9v/p5LEKCK1BzhIakCwlnwB2k3ZBwL0fH42P+zPAwkQ=; b=naseOL28GRTiPyK9KMf6zPt4Dg3hMGXOyJZRTd7Wm+fe3hV1oEqP6DZAxtHVMOqzxf0wxnIpjcxXJzYvmIE1eUcsRn+LAOf362VbC7r4LlqbWlARX763yxG6ftN7HliIhNA2NO6cQZiUXIllJDchUoc7DZxNeaL9aPq6o4aL0r4=
Received: from BL0PR0102CA0010.prod.exchangelabs.com (2603:10b6:207:18::23) by CO2PR01MB2021.prod.exchangelabs.com (2603:10b6:102:6::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1495.9; Fri, 4 Jan 2019 21:55:46 +0000
Received: from DM3NAM03FT062.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::201) by BL0PR0102CA0010.outlook.office365.com (2603:10b6:207:18::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1495.6 via Frontend Transport; Fri, 4 Jan 2019 21:55:45 +0000
Authentication-Results: spf=pass (sender IP is 18.9.28.11) smtp.mailfrom=mit.edu; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates 18.9.28.11 as permitted sender) receiver=protection.outlook.com; client-ip=18.9.28.11; helo=outgoing.mit.edu;
Received: from outgoing.mit.edu (18.9.28.11) by DM3NAM03FT062.mail.protection.outlook.com (10.152.83.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1471.13 via Frontend Transport; Fri, 4 Jan 2019 21:55:44 +0000
Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x04LteeG029567 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 4 Jan 2019 16:55:42 -0500
Date: Fri, 04 Jan 2019 15:55:40 -0600
From: Benjamin Kaduk <kaduk@mit.edu>
To: Brian Campbell <bcampbell=40pingidentity.com@dmarc.ietf.org>
CC: Neil Madden <neil.madden@forgerock.com>, oauth <oauth@ietf.org>
Message-ID: <20190104215540.GL86936@kduck.kaduk.org>
References: <CA+k3eCTKSFiiTw8--qBS0R2YVQ0MY0eKrMBvBNE4pauSr1rHcA@mail.gmail.com> <6A614742-290D-47E2-B3E9-A4D49DB32DD7@forgerock.com> <CA+k3eCSoNRGrsxeLYd6DEqU+U6TB_aXV2aPUa07Um2X0ZH_ZEw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CA+k3eCSoNRGrsxeLYd6DEqU+U6TB_aXV2aPUa07Um2X0ZH_ZEw@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:18.9.28.11; IPV:CAL; SCL:-1; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(376002)(39860400002)(346002)(396003)(136003)(2980300002)(189003)(199004)(97756001)(36906005)(476003)(126002)(50466002)(956004)(4326008)(75432002)(106466001)(9686003)(47776003)(53416004)(16586007)(106002)(54906003)(786003)(86362001)(11346002)(446003)(55016002)(316002)(426003)(58126008)(229853002)(486006)(14444005)(5660300001)(305945005)(26005)(1076003)(76176011)(104016004)(186003)(8676002)(7696005)(23726003)(8936002)(246002)(6246003)(356004)(26826003)(508600001)(336012)(88552002)(2906002)(33656002)(46406003)(18370500001); DIR:OUT; SFP:1102; SCL:1; SRVR:CO2PR01MB2021; H:outgoing.mit.edu; FPR:; SPF:Pass; LANG:en; PTR:outgoing-auth-1.mit.edu; MX:1; A:1;
X-Microsoft-Exchange-Diagnostics: 1; DM3NAM03FT062; 1:0oudJNgaDdO7PhrgPTfGaYQbW61HDX5xYBVMFH3e6lANhfMjYafEln1Rk0XmWjIX/h0z/kuabH/QMlUqpoystQ77hWbKvh0+bVaivrp4GjT9Q/PT9vjWQni0d8tgGS1N
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: bbeeb7f0-cb6b-405b-d34c-08d6728f6074
X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600109)(711020)(4608076)(4709027)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060); SRVR:CO2PR01MB2021;
X-Microsoft-Exchange-Diagnostics: 1; CO2PR01MB2021; 3:pGj8RKFz5i2ubOLZgBkscYZmfZ8YEOdVcIbbjmfnXL1gYBErWkWRdKIDwDfFQerYOuvCUDuiYSgNplHIpiMTp22Ul5tJm6QrgoyaxYsRTSwfBDYlAzQdyVI5yQ464FAq5r4qacKui5NU9NNRAQNQkFTjy5bNhbGzIFFcO83eTXGBu+NrgGFAURlVi2qz9+BmSTOB30i6AXVQeKcmtX4DYHCCBAKwrQHRSUNIrroyq/tsYxUcys8DTbJkooPLIyW/JuRXOrMRX6lgEJla5Vyita3f6s1GfsuJp3kah+rhQOkQv+56CCVrTFXs040xXNeHI1fuMSb51kCmiAbkTPOpimBP0Moe+r2zm4tnmSrQ3RvLS+y7udy+CT3IQMlxX3CK; 25:4Txcp6kmZ/ocI+XBw1Lc9Eya/7tJBXucfwFu3NX4ew4F5K/cuB4hQ7xEj/4x0lb926ESIyy4xthmDaRluepU7VMf3Tha2T0tYP0gC/Lryseq+oxHbxr32WJsogv1ApIOXc6cgUhshV4tfNU+61AO3qxGiRhlsGcUBqoB3KTe+3ffbhlJR7ULh10eX+8UHDGGItgYeM5TltNf9NUCyuWmYtc8U1d+AkSpEaaayOJ1NNFTX+CeQs83tXVuYrWsWfytS48PJEk1tsnS+ixvmm6gMhl/Y/ugjysqwuH9D3KaP4fbd7SZf8YUm6cSe95NyJlXA95mjsqL92NPv2ZIV7ffpQ==
X-MS-TrafficTypeDiagnostic: CO2PR01MB2021:
X-Microsoft-Exchange-Diagnostics: 1; CO2PR01MB2021; 31:Ysd87nKnwgp0TaaGof8Oin3Clb9IU2umBvTfSbkY+0SASyVF1xQwL6TSzYK2/r8nJ2oscfBtMrJfpt0C6eN4HZmSq9xNU+7lg6G9vQkgngeMUVTHz14+4rHGFZkt6hvxsV3beAP7MuPAJpmU8tv/NxHB0RbRyZIFAgL4H/8x7FXPvDJu2LXHaHh4d4qE3thcIiSDVPE6sce+uKL3IN7REO5E6A2JjW9hP0ellYyK2bQ=; 20:0nwGAN4TKjj7k4Q+jNqFPNqSX3rCfxQ+G/XYKmRRs49/LgWtcX4njpG8BFIAacQaHaZ1cN1xolLUm8DOgtCyltrlDkECSC0yooQF94h86/55RTy0645JTc5I11lvkIZRtGihREVMuI+2QHOuGVuhb0gtbTPiBy8HvuhWMHdQNX4T04TnAFszqmTatNppuJboRe1Qzd76zuGrEoD5Lxgry2Q38aOE4RVhGNpWyU7yKnthNP3FIuJxJjrH+7SbmViv5UrdzYw6r4mO6msg6JV54RWOusffG6iH5PFXbe9hnqZC/zQQr1/Sz9DaRFfgDJzX1Cq9GMuNpfwQGoD5971vUxtLYKtnw58THR/ZjJOSu8bh3sByratam/1ahSlU9/sMOsfUhU9dJF1ug956Uw2EHaN4SA8ZHh9wql3xVQmrl2lLdy6u4AcriLrXvuXMqLwcfc7r6OEjqC9DGX0gsI0gKjBfn7w/s+SlNGlUjpbGNyu9oS8s/Rm0o7+RdYP5xdjq
X-Microsoft-Antispam-PRVS: <CO2PR01MB2021E123897086150BCCBD9EA08E0@CO2PR01MB2021.prod.exchangelabs.com>
X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(3230021)(908002)(999002)(5005026)(6040522)(8220060)(2401047)(8121501046)(10201501046)(3002001)(3231475)(944501520)(52105112)(93006095)(93004095)(6041310)(20161123560045)(20161123562045)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(201702281529075)(20161123555045)(201703061421075)(201708071742011)(7699051)(76991095); SRVR:CO2PR01MB2021; BCL:0; PCL:0; RULEID:; SRVR:CO2PR01MB2021;
X-Microsoft-Exchange-Diagnostics: 1; CO2PR01MB2021; 4:+jy6eiSCGpHYRla4bMnMkIvb3sReB/CS4BRwICFJJGmxuBV6ymCxrGya+1SC8boT6I/I/5jujQtkwWNoGbO+a0akZubbYsOGMXu5tX4r/G0C0Su48NF3eGyvtFcE0pA+Yt1HEIybvCgbVIedA3uks1O3gDFDehBZjqqiijUzP8wlxoIrV2XyJ8kCx8jheZOerouWQFQa9DAgEhbRZFGxEW1/5Z4w0+fxgdIJezR8NrUvY3uS7pp8mFXjE0mwvHQ6Df9nQ8HN15uU7qzH05TVUavmQFOYAxWaQbpPUxlLpKQ=
X-Forefront-PRVS: 0907F58A24
X-Microsoft-Exchange-Diagnostics: 1; CO2PR01MB2021; 23:eq76GLzcJUDREAS5SsQVvTHxUvV/qDLmlN2oCvypoicj3CN+9FkhwggFCfZrw4CVFBCUw0FGwN184hEWVPF44dvtbv6EJXMt0O4acfo1YCYZEY2xXy2deNZ+k+nOZQjJ2CZByOYoLH3yIdSY9liVuOj8jlIXKiP4i2dbYYG2SIx41aButtY8YTu6mPep4x7zP3znc+qrPxWbvSJRftxtYr7EuUybHNynzTMVbPoNOCCweed58xcfUKyUGY60UTuZNGXcOquaxMUFLOWzazj6jqYwVXFilCuvzleS6ysTnusI4raMGjYzuA9eu/M0SXkRAWmd5lbe+xpnlRxzgzQUr2SeTaq0iZSFssxAlCmaLPgW39RTw4gt+tqMypqKDfCzAhRSyAjGXADPFwiOsp34sazpBPYr1trzvIJe2SVRCty3luK40esbFE+rJEc85xFNz5+0SF7u+RJ39sL0KWau6pJB4O0blVlxQ5Nq1d43GWuSXmOCxqhVhrDq1SwEbCZ5L5cezmPeH/9Zwy/ZnOIc9Y6Yrpm03jBxTKEywXfGbCNZd9j02kjRZIwCfOfQlqKauL7T8ySsPJZE4J7UPkwWThtszoyVAnVo+gLODoNAD9ttkERggFlM3tgwjRRZc9zDGVqndCUXnuvW15G/fgsexi2r5u8bz35Yd910TCSyXC44wqQnI0K0UXwFKOgWapOyG856VQWTxg9mE4dcyU4xNR4SSIu3m5/XepOVQxKGJU+ljAqjCT60m7DTmL19EPYiJUkAcbJHFdLdg6cLZFlZRYkAEP069HVxQz8oDNBs1MO68Gvphpc+MrBw657JDUHu28ZTYkGLaPkcQ4Nv15TVjmezOEknziwCEFP/+TzaGYnvTAo6zngCxSITb8ibE6dIZzq1mBza95K7Q9jJqBpmSr8tUskVulfnoRRzQTN0kvIIAbyAxk3o3BV6Vs/PL4pWeYpWfAcYG8qmdwz0SdMgAN0ZMWUAEpQoSv1nC2jvF0ZTkIcSUdpcb0loOG9EvWXVnfGKno0nrMhQbEjf71mdMgXPS24TsEozw1Im7I7CvYaCIiILP1EBM9m/Ytv/+XQ1I67/WryH16TJt2vfQhiRv5IwNVb+o1GxorFsvM6iJNmcX8c1obZFNpIuJvrsIK6U9EzEEwfZXSOqTW67DQeDRUqU+2DgLt7LEZz0jzMS8uzDFNs/4wpRMWBwxEB5iPbPoDdxqUpbFyihURGLfTDxRA==
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Message-Info: 0cFtzXVi7N+r5La+KBGN2oYaZ3xU97MVxcjHVDO02lyb8RH2y78SNB3VEFQb0BEWL6fRa2AJ/flaYLD1v/aXxuNyYACYCQ//WDYaOupJG0KOM2dOmtPIomH3wzGhgMUdq5e9A6pc4FRsmedfbBZUaGLFEh+uA38/m05P8c7UsaWnZ5IIDj3tktqJlt8CqzgVO+Oa/L0ledBRN4/V5FxUsOMHovVGCU+pqRpdhxr7IKQ95+k8SgTRhhJeNHj4urXjOU1skTDLsAgGkALO2IRNWumnEjDOreHRexyy0GJqxRfY2PGtbB5TqK9/Vw6qk0fU
X-Microsoft-Exchange-Diagnostics: 1; CO2PR01MB2021; 6:hp82kjUIdJKttlhfrvjOvSIuruWJVsL8vV+2u7TgEkDLILQd88yt4ALAnBqZKALpuIwuqzw1IpiIe3jAbV0uBJlpcSOEhtrY0Dv1BeHsOcOiyb0OtabcgwjlnRG98s/gcChEwjNgrqQTn2PFXWE2gGGEZSvf4CtxCf7r/Ss7U7soTgnSQkPdql2RxtIRc1j8IKTiznqAbA7W7mc5WGAdAkXgPfIhHTcydSnbHr8/VkVea4FAEPMCg6VGbVrBHGX1sYfiA1PqZ2fL2EtmDb1K3Hhlkrqj/+bKjDtbxB58IAcD3JUSthQs4XkDfb9UmngOxT8CNmA5yNl5elm3R780Foqhl2TDplIsYGQZPhm57eweg3W/JOT5mUkTksUgsIWVRJoK/Sv95JHISctlVew7P2K5qO+LB+8uqjTOE/8ru1gvy4wr3xWV2N0M13r9T5GeljWnexuShuRy0gx4Zs7tBw==; 5:eTbODYwVHnpBJra776ggDJ9DLh9pGCvkvUyzJr6ZqLtC7HMWuYqg4sDgCzRzaBXOYCZ3YpPKrM2T3E78d9imEhTwV2XD6wQthHImnREsQlKAEKk92rh8KPuPHsGiVOgqM41Q5k4tuo4tBQMZVOXJ+s9iGDnKNBiLOorpyr8T9zFu+d3pTDEFZ4MAkvhh/ZM0pHBE5/s4hMbC97I8BjPUBw==; 7:LAe1VF7kNI852odnhMQ8dAPKXTBAA+F9lK4Z4ZApvITg+GjJ89crspU5+MihD/ud2yI0XsE9eIE/hvB7fzIIbOZySO5NIumlkO4ggU8k9GKZ1zlcG56nRLOLcDOZl9yu5lwWuUCEqi03ShiRa107lg==
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Jan 2019 21:55:44.0224 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: bbeeb7f0-cb6b-405b-d34c-08d6728f6074
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=64afd9ba-0ecf-4acf-bc36-935f6235ba8b; Ip=[18.9.28.11]; Helo=[outgoing.mit.edu]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO2PR01MB2021
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/_uk_TS56WXjxuak0Jztx2zNQaLg>
Subject: Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Jan 2019 21:55:51 -0000

On Fri, Dec 28, 2018 at 03:55:15PM -0700, Brian Campbell wrote:
> 
> The observed behavior of the browsers surveyed seems logical and rather
> reasonable (and better than the last time I futzed with it). Importantly it
> means that for the situation described in the email that started this
> thread (a javascript client making a fetch/XHR request to an MTLS token
> endpoint), users using browsers that are not configured with, or have
> access to, any client keys/certs will not see any UI prompt at all. I
> suspect that not having client certs set up is the situation for the vast
> majority of users and their browsers. And for those that do have client

Is this still true when we limit to the set of users/browsers that are
employees of big corporations?

-Ben

> certs set up, I think they are more likely to be the kind of user that is
> able to deal with the UI prompt okay.

v2.27.8 | Report a Bug | By Email | System Status