IETF Logo Mail Archive

[OAUTH-WG] draft-ietf-oauth-rar use of “WWW-Authenticate” Response Header

"Oliva Fernandez, Jorge" <Jorge.OlivaFernandez@santander.co.uk> Thu, 25 May 2023 11:15 UTC

Return-Path: <prvs=502623c84=Jorge.OlivaFernandez@santander.co.uk>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FFA6C1519AD for <oauth@ietfa.amsl.com>; Thu, 25 May 2023 04:15:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.394
X-Spam-Level:
X-Spam-Status: No, score=-4.394 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_NONE=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=santander.co.uk header.b="lT6SLuqT"; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=santandernet.onmicrosoft.com header.b="jYBlz5kl"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dlKRXJ1nzH-k for <oauth@ietfa.amsl.com>; Thu, 25 May 2023 04:15:54 -0700 (PDT)
Received: from esa8.santandergroup.c3s2.iphmx.com (esa8.santandergroup.c3s2.iphmx.com [68.232.156.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B846FC1516FF for <oauth@ietf.org>; Thu, 25 May 2023 04:15:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=santander.co.uk; i=@santander.co.uk; q=dns/txt; s=prod.june.2017.ab; t=1685013353; x=1716549353; h=from:to:subject:date:message-id:mime-version; bh=ptlGCqQsQj1aM0X/SXLneXV7g0fbsAIXzyjbtrs68Ys=; b=lT6SLuqTgwItrv8XO9c6s3e3OZ/fIgz7jaLYXuOtUS6VfXWpatJ0LDYJ 0n8I/axVGUiGwjpRWB1HwzVrR6kKQQ6T6gJO1Im9XOXsTJqwJU9PPqC9t e55rOM4sqk+KEDNqUTQNRxKyX56YA4MftE26KPoOhcikCmaLi29W1CC4d k5gSj0c1XJ3J7rTpEtabDTF7jDqYlE6YFAVYPTEZlYWEb6olWDKNXU8vG rBa4B9MFoyAWuPE4FLCDAmDmmM9g8z1X1ji/OxsWQg+dDZ9QZfbuV1rAa paDEzKkuWL+WGgb7lWRqWX1LC4NUiQToOBwq55dYVRXK5CoHKuQ1smkZf g==;
X-Recipient-Count: one
Received: from unknown (HELO srvexgpvwsk07.santanderuk.corp) ([195.43.49.198]) by ob1.santandergroup.c3s2.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 May 2023 13:15:51 +0200
Received: from MAISRVCPRWSK30.sanuk.santanderuk.corp (107.15.166.1) by srvexgpvwsk07.santanderuk.corp (10.10.157.17) with Microsoft SMTP Server id 15.2.1118.26; Thu, 25 May 2023 12:15:46 +0100
Received: from MAISRVCPRWSK15.sanuk.santanderuk.corp (107.15.75.25) by MAISRVCPRWSK30.sanuk.santanderuk.corp (107.15.75.31) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Thu, 25 May 2023 12:15:45 +0100
Received: from MAISRVCPRWSK37.sanuk.santanderuk.corp (107.15.75.38) by MAISRVCPRWSK15.sanuk.santanderuk.corp (107.15.75.25) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Thu, 25 May 2023 12:15:45 +0100
Received: from srvexgpvwsk05.santanderuk.corp (10.10.157.15) by maisrvcprwsk37.sanuk.santanderuk.corp (107.15.75.38) with Microsoft SMTP Server (TLS) id 15.0.1497.48 via Frontend Transport; Thu, 25 May 2023 12:15:45 +0100
Received: from EUR05-DB8-obe.outbound.protection.outlook.com (10.10.157.4) by smtp-eol.santander.co.uk (10.10.157.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.26; Thu, 25 May 2023 12:15:45 +0100
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Yb8xUQBWH9oExXmALzgu4TsoHFrrbpstIIrudmw/6C5WFQzFqHYdnSaW2VECnVUetg5AIRUqf2cINJJy033DNcHQ3XP3tRm8OC3ku3l/sMWKL4xUjcXl4nkdsYQLKwoCR52RCHvWUQU2vl7XCTYbYH3lGVidVqKgyfgwoXhThWWg/U7y5PlKuuVcBSuZbKx9cWu3/fExmKraaDrYRwZaO0UVg5MgdVd5mkkoEDyj5giITIZgcZdVj9YnABlVsevicphPgElnbtRdh+Wpu6wGgjCwQY/VhHoAcwAUAFBA6xNV+x+8zdj139/KIQ7WpTWQBouBL5HXOCUPtWDudS5yXg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=50bGhp8RmGqFzWBRmLHboQjCQk91YipYQLk7GyaqEkQ=; b=CgteRtTWg86/x1Gb/yKDwpaE8Cc8vAyG+0sJkr6V+mNlH6JxgMmVGcWCK9knWMR1MArqS58GF7AYoirEptbR4eHg6+AEkMmjDi3RUt4NsZJXfJzEctGOCdR/XLGMBcZh236d0dcCLGZZajMcYqn9r9KhcmjgnapKaAxFHwagzQK5HXlVdned1tVMZt8ao2FOjAeLo/xPJMhuuwK2yrLAw8KX8rUaaJlrLGWS/3Q0Q9IzLLYl44Rupu3b+0S/Mablm4iV+XldS5tWxhMWiXz2g19/CQXhYu+ogw/0xIoZvQmysfvFEfPX4gq9Ibq3ATQIe+KX+Y+aJzSq/ZVBJF9I8Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=santander.co.uk; dmarc=pass action=none header.from=santander.co.uk; dkim=pass header.d=santander.co.uk; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=santandernet.onmicrosoft.com; s=selector2-santandernet-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=50bGhp8RmGqFzWBRmLHboQjCQk91YipYQLk7GyaqEkQ=; b=jYBlz5klxvd19wbEoOO/pDGp6+RDKQN0ZucEQASKhXRaqeS7lQaiA1hKFdjq0mprNY3TTCT/xuIWXNTluH08Vg/zSsBeM40f3BJfzn9Zpm7jJaKHfSvND6+wgimIfYojaFngCgU7tkmDoOp90wMySf/Xafu0mFTpcfnzQLmF8BE=
Received: from DB8PR04MB6681.eurprd04.prod.outlook.com (2603:10a6:10:10f::33) by AS8PR04MB8039.eurprd04.prod.outlook.com (2603:10a6:20b:2a2::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6433.15; Thu, 25 May 2023 11:15:40 +0000
Received: from DB8PR04MB6681.eurprd04.prod.outlook.com ([fe80::87e:2ed6:4570:6dcb]) by DB8PR04MB6681.eurprd04.prod.outlook.com ([fe80::87e:2ed6:4570:6dcb%7]) with mapi id 15.20.6433.015; Thu, 25 May 2023 11:15:40 +0000
From: "Oliva Fernandez, Jorge" <Jorge.OlivaFernandez@santander.co.uk>
To: "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: draft-ietf-oauth-rar use of “WWW-Authenticate” Response Header
Thread-Index: AQHZjvo9ScjbHmgd+EuuluxD1c4KpA==
Date: Thu, 25 May 2023 11:15:40 +0000
Message-ID: <41869F2A-F0B1-4409-8739-5BB3A820CBF6@santander.co.uk>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=santander.co.uk;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DB8PR04MB6681:EE_|AS8PR04MB8039:EE_
x-ms-office365-filtering-correlation-id: 5ac3bb6e-6e79-4d77-2e7c-08db5d115fb4
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 9hMVeqECfwy+EP8bmUNHrhEMbx4nfZqkRqKk8afJcvw/WaKRoRdiTopctSq2lwIcVXS7HPIoniamMVqtrdwBxL2sEaeCCpty64C6GlulPsekLIg6elf5IrlM6XfmWjn1qYsc4WlpHVzX0y/4ynhxSUhsTlpb3neXfD6vODu/PvX/k7Rf+0/TeY4j908NTeIekh8uf5wBQtTVhUEm0R5DO29OUKkQV0KMCX7uB149UQDG2YpqKH4lKDtsoZC4FBEdkXqq4u6X1aNnqyjDtXlugQRjR+Ge22gJTBH0b+FzA17zqRQkmKh3k4axlsMSgvjXVlKW+XGEkaMlvJIP0283twjTBGpidToqmYyjTXi8AfqOd5jEXDwoJW7wwI13D08tp/CtuQzj3sw+aAUuo2xABnJXCsOgXGYM0i7ZNb6TNIzuzTp5tFgcWd6QPLpa/bz77H+w9ILtHjcGPWBNnunKgA0bn7AURu4pxPAv9OXCCehrIfhxn7TI+ZsfBuRS3RJg1r/OSBGUTTbfugbe6YH9OofTcCe2dIZmAP2qOj7oFU3UFvsA/39XUkza40UAQaNpUn7VLUy4qk+5PpuDpHzokHtMw+idlpfiR+7AJ2Ify5O+H6MYMv8yhVyWUSxWbM8hdqsDI9H8bufu7o3kYrgJ0Q==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB8PR04MB6681.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(376002)(346002)(136003)(39860400002)(396003)(366004)(451199021)(8936002)(478600001)(9326002)(5660300002)(186003)(83380400001)(86362001)(26005)(6506007)(6512007)(38100700002)(2616005)(122000001)(82960400001)(166002)(38070700005)(41300700001)(91956017)(76116006)(66476007)(71200400001)(6486002)(10290500003)(33656002)(66946007)(64756008)(6916009)(66556008)(316002)(66446008)(36756003)(4744005)(2906002)(10300500001)(45980500001); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: Fi6dinBvIpQ9tJvX9A7sIWQxVCwUdf70oVzDnYZX+CJnOuJSvvE3GGlE8qYkq/EvNCoUhNBvBSS5tmPhWo+0ppT6cMfwmL79FuAaPq51z5Slg1yC2qyW5biLIxmaT2krlW0n4JLgIOjPG2r6JBx5ISfwV30nyIif2KSmaXB3MWpq7tJqE6NyBSW92UTIm81DjEQrvqK199ks78MdQ4XoW77sYCq8nUKUo7L4s6fGu/DJeXkyPA9ew9TNqlOk7iEXAwHcWwxcW44jgQ3PrpdSd2isFmXLPlP+Mx5gRHocVmBgcM2ye7CtvEtqq3fflQMKmAqv/vtpQOGv0hKXtqau/cXC7GNID6nTOCKpvSggWhXHJNudqdrQLS7G9WQ7xg+C00oofXZn1Aee4Gme79EuPLUTqG1gFgbyvwq3krdi6zsq+lmH3/STQyN/O8/jdcdq7BI4fQd/uYnT22LQ2ut1GUDSvqSGX5DjWfz0Yo5Sp1jubOP9ES9YLftUh/Ygf+FNH4xudqi+0PjpfbCh/jSjtF1HkPwj1FSroZllZ+Yn9PXEjn+k3ziT93sOoILxMBbtfXJXoU5GnRyfljnQlnqs+Lnmb8NX8rv4ox2ltY/XGrE9ze4g5Z/X8VkHvIqh2LUaeYuUWWPAtI/qu4DAQxcSAVNEWtf22UMntNRpqIQ9JqXfaKoF6s0SmTWz2JJPtcshjvwsH0Q+AJnylkaNaSrsZtuxTER5ubLlPwprQOsr141+TFxBCO7HqfbtrRORfbkuwU80UUDP/tIweNDpeliNfz+hnXEH6oD8QOW8t/tfeYKU/cwOUAvKo8KHBNsirMoXZKc7WgCNwKiAWtNT6C8nDjDbWGXPXgpcORUgxTsjx7z6DRbX386BrLWWcNKib+JNGal769FsZWVrMHGTyQsPHgg4738OwbI2/ebU4orhVwObfIMB4DQOjmpCuqQLD9xrsgXib1ubvT70WBFY5TvdxtaZsXV5t+wfUNq01mt4tn8skUoMU0eeAtqwAJM3IMPIL1In8vHXRUFURhk5cteK9CiAxnPul1FnvmpZ9oFnbv/jHtC6Bm0KHkj3pR1O3Spqrp2OuHEr2QIooklf8yzabvEtM1EXRQVHXMriwx+OemvK4wZxjCRifLGJ2xLiG5JWZUXxX30fKGne+6CWlAEzdFh4I71cGCSKVAz9ANiP2gr5afMD5BpUzBhbUWLRPGNBpyDY+Dilm8bNe9HkhtAQiNJcYjDMWWuST11xYifdlO9x70/Lm/gJA0nf9uQ45GdvDv+LZR4IokdnmidMSE0a7lnFUaBo7BvU/VBhi1EE0CClGfV8Gan9AF7/dbqRSmvZSa9st4txcMwyci+idD3O0lPtbwLd6qqgYAs+iu0nqHx9Tv09TOXHkOBbV2301Wi6OqChA/VkueF2oQ9J5Jy7xLo3glGIDqkJe5wzC3l16qnEv1zDivnMX4zPA7U6JAw9vj2+TF3GPXWNuhqGkzIpQ7ilwzuia2UNb6DAz/pr7RxklALQEgu40n2uSkkaj7t1G8WXMvp+56JxlA9nZMTsY3VjnW8OU8AUthZ5ja3LtP7HkRLIVMnyPpvxwgSfDaZGx5rFf8OrbAvnwJsuJqrkPCeSzj36va59Q8PoItMG9pM=
Content-Type: multipart/alternative; boundary="_000_41869F2AF0B1440987395BB3A820CBF6santandercouk_"
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: sApTk87HL0xTVcjUC6ooMzO0LeztSdBw3L+2BsACzuExVReWOeNa/QrZNEXjKzGQpkwgBleERZ0YnErC7XahbJ2MV+Z8QDXZzKW7bnD+aaAoe4u6IeD84ji7CSnOO9gR1dY0gMrRPE9h4wLHRVGKpi/6khyTNjWRdLCMOLY3Il69UGyi0tFyRc+ISCfWVRHDOmj4xWM8jT39IGdWe2f2UtAu2pzIX4Pv3hXEliEsfzDEUuBGd9XsI058dezLlYBaqWl9QJpoHZUNae3asXBGHON9T9nB0yM+wrnfMiritDM67cgIDOmqTNL9sBYLp5bIoNaaNsCa4lY2eHtemQDR+0Tiaocf2MeH5X3FS6chWQImiIJ7WdxqQ4AiSuRY2It7lTItE25Rj3B6FPC1czOEVmihTzQZ68AwMFc/JvP8WB/ubTf/QPtK4QqUTYOQ5KLAiHxs/w37BTrLFv3lESCQ/eXq3bz/qL0BK5XQgjYHCylGs0Mmp8354fdBKxFmHP+gvDtJQtuDwWiyVnCuGdBV/NyTzfp8m20PsCr5RXC5NyWCwCTftHyPZXuijcWoDH9QNQasPOiESiy2kXO68peat6snGRpJz8JKcMO5+D7S6wSvps9wFKOB2+QQ4ux9T7dLWfK6H8tO4a6lvtKbWru6aevJxk7uvzVV1o6W32Q0/5uIABH32u4HUEwyApiejtftRfpPtj8CiWhW49XsQJhyt56Y/TW95mHq4oTPaTp1WOIY8NfIPm3E8E15CqC1qIlD
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB8PR04MB6681.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5ac3bb6e-6e79-4d77-2e7c-08db5d115fb4
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 May 2023 11:15:40.3915 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 35595a02-4d6d-44ac-99e1-f9ab4cd872db
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: yEoEcY9x1BajpYHXwJ+VLXWM9EJQC4gMThFCT4KH3O5iOnNOv+16YIfvBngoJz+WcK/KJivZzRxK+Ve5j9J54nTrxqUkRFhfBU9ZUEsCcgsVZOf1ESfe+MOz7k/nGsCn
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8039
X-CFilter-Loop: Reflected
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/beBdu32qaCK-SMiK2FnO2--45zs>
Subject: [OAUTH-WG] draft-ietf-oauth-rar use of “WWW-Authenticate” Response Header
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 25 May 2023 11:15:58 -0000

Hi,

I have been reviewing the last RAR draft (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-rar-23) and I was expecting to find some references about how to use the “WWW-Authenticate” Response Header Field defined in RFC6750 (https://datatracker.ietf.org/doc/html/rfc6750#section-3) in this document.

I think that RAR is a great idea for complex authorization where a “scope” is not enough to describe what you want to authorize, in OAuth 2.0 there exist a way for a protected resource to indicate what “scopes” are need it to consider the request “authorized”, should not be an standard way to do the same for rich authorization request?

Best regards.
Emails aren't always secure, and they may be intercepted or changed after they've been sent. Santander doesn't accept liability if this happens. If you think someone may have interfered with this email, please get in touch with the sender another way. This message doesn't create or change any contract. Santander doesn't accept responsibility for damage caused by any viruses contained in this email or its attachments. Emails may be monitored. If you've received this email by mistake, please let the sender know at once that it's gone to the wrong person and then destroy it without copying, using, or telling anyone about its contents.

Santander UK plc. Registered Office: 2 Triton Square, Regent's Place, London, NW1 3AN, United Kingdom. Registered Number 2294747. Registered in England and Wales. https://www.santander.co.uk. Telephone 0800 389 7000. Calls may be recorded or monitored. Authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. Our Financial Services Register number is 106054. You can check this on the Financial Services Register by visiting the FCA’s website https://www.fca.org.uk/register.  Santander and the flame logo are registered trademarks.


Ref:[PDB#1-4B]

v2.23.0 | Report a Bug | By Email