Re: [OAUTH-WG] draft-bertocci-oauth-access-token-jwt-00

[Hans Zandbelt <[e-mail]>]

I may be missing something but I'd argue that by requiring and comparing
both "sub" and "client_id" we achieve the same semantics without a
new/additional claim (barring name spacing)

Hans.

On Mon, May 6, 2019 at 8:58 PM Karl McGuinness <kmcguinness=
[e-mail]> wrote:

> Makes sense that we don’t want to further couple AS and RS with grant
> types.  I’m OK if we want a dedicated claim to establish whether the token
> is resource owner delegated  vs client acting as itself.
>
> Subject Type is already a concept in RISC.  Just making folks are aware of
> prior art.
>
> https://openid.net/specs/oauth-event-types-1_0-01.html#rfc.section.2.2
> https://openid.net/specs/openid-risc-profile-1_0.html#rfc.section.2.1
>
> -Karl
>
> On May 6, 2019, at 12:42 PM, Vittorio Bertocci <
> Vittorio=[e-mail]> wrote:
>
> *This message originated outside your organization.*
> ------------------------------
> Fair enough! What others think about it?
> Exploring the approach: would we want a bool claim or an enumeration, e.g.
> sub_type = [ resource_owner | client ] ?
>
>
> On Mon, May 6, 2019 at 12:35 PM Vladimir Dzhuvinov <
> [e-mail]> wrote:
>
>> Hi Vittorio,
>>
>> On 06/05/2019 22:22, Vittorio Bertocci wrote:
>> > It is true that the grant_type is a client side consideration. I did
>> think
>> > about the "client_id==sub" heuristic, but that's not always applicable:
>> > many systems have their own rules for generating sub, and in case they
>> want
>> > to prevent tracking across RSes the sub might be generated ad-hoc for
>> that
>> > particular RS.
>> > Would you prefer to have a dedicated claim that distinguish between user
>> > and app tokens rather than reusing grant_type?
>>
>> A dedicated claim to flag client_id effectively == sub would be
>> preferable, and much easier for RS developers to process.
>>
>> The AS is the authority and has all the knowledge to set / indicate this.
>>
>> I want to keep RS developers away from having to deal with grant types
>> and having to make decisions whether client_id effectively == sub.
>>
>> Vladimir
>>
>>
>> > On Mon, May 6, 2019 at 12:16 PM Vladimir Dzhuvinov <
>> [e-mail]>
>> > wrote:
>> >
>> >> On 06/05/2019 20:32, Vittorio Bertocci wrote:
>> >>> To that end, *Karl MCGuinness suggested that we include
>> >>> grant_type as a return claim, which the RS could use to the same
>> >> effect*. I
>> >>> find the proposal very clever, and the people at IIW thought so as
>> well.
>> >>> What you think?
>> >> The grant type is not something that the RS is really concerned with,
>> or
>> >> should be. Introducing this parameter in the access token will create
>> an
>> >> additional logical dependency, plus complexity - in the system of
>> >> client, AS and RS as a whole, as well as for RS developers. The grant
>> >> type, as a concept, is a matter between the client and AS, and IMO
>> >> should stay that way.
>> >>
>> >> Clear language in the spec should suffice. For instance: "If the sub
>> >> value matches the client_id value, then the subject is the client
>> >> application".
>> >>
>> >> Vladimir
>> >>
>> >> --
>> >> Vladimir Dzhuvinov
>> >>
>> >>
>> >> _______________________________________________
>> >> OAuth mailing list
>> >> [e-mail]
>> >> https://www.ietf.org/mailman/listinfo/oauth
>> >>
>> --
>> Vladimir Dzhuvinov
>>
>>
>> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>
>
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth
>


-- 
[e-mail]
ZmartZone IAM - www.zmartzone.eu