Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-access-token-jwt-03.txt

[Vittorio Bertocci <[e-mail]>]

Hi Torsten!
>
> just to make sure I understood correctly. Are you saying the client has
> credentials but is not authenticated using those in all potential
> scenarios? Can you pls. explain the rationale?


Yes, that's the scenario. In Azure AD you create an app registration that
generates a clientID you can then use for web apps (confidential), native
clients (public) and the like. I believe you can do the same in google if
you create a clientID using "other" as app type, but I am not sure. I am
not 100% certain about the rationale, but I suspect it could be a way of
say optimizing consent (if I consent for scope X for the iOS version of
app1, I will not be prompted again when I access the web version of app1),
provisioning across tenants or grouping app policy options.
Even before that multi-type app registration option was introduced, AD has
ways of making confidential cleitns behave like public ones: web apps that
do have credentials, but whose clientID can be used in implicit hence
getting tokens without using app credentials.
Whether that's a good idea or not, the features have been there for a while
and there are large numbers of apps in the wild alowing for this. Let me
stress that I consider this area a nice to have and I am happy to drop it
if it's too problematic (in fact it's not in the current spec language).


On Mon, Dec 16, 2019 at 11:28 PM Torsten Lodderstedt <torsten=
[e-mail]> wrote:

> Hi Vittorio,
>
> > On 17. Dec 2019, at 05:19, Vittorio Bertocci <Vittorio=
> [e-mail]> wrote:
> >
> > In the cases I have seen, the idea is that a client (whose clientID is
> already known to the RS) can obtain tokens thru different grants, some of
> them confidential and others public;
>
> just to make sure I understood correctly. Are you saying the client has
> credentials but is not authenticated using those in all potential
> scenarios? Can you pls. explain the rationale?
>
> best,
> Torsten.
>
>