[OAUTH-WG] OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution nitpicking

Antonio Sanso <asanso@adobe.com> Thu, 13 November 2014 10:59 UTC

From: Antonio Sanso <asanso@adobe.com>
To: OAuth WG <oauth@ietf.org>
Thread-Topic: OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution nitpicking
Thread-Index: AQHP/zDS7qAbUTMlFUWe8KP0OkV0JQ==
Date: Thu, 13 Nov 2014 10:58:57 +0000
Message-ID: <77D02F4C-4C5D-4A9A-870E-6EEEA92CC745@adobe.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <FE51508C7394F746A72388B7B7954B79@namprd02.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/e6u9S61ARLkowTKq9NIhm6mn9x8
Subject: [OAUTH-WG] OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution nitpicking
Precedence: list

hi *.

AFAIU the access token in the  Client-to-AS Response is not “forced” to be JWT format but can also be an opaque string.
Now the example rather says:

HTTP/1.1 200 OK
     Content-Type: application/json
     Cache-Control: no-store

     {
       "access_token":"SlAV32hkKG ...
        (remainder of JWT omitted for brevity;
        JWT contains JWK in the cnf claim)",
       "token_type":"pop",
       "expires_in":3600,
       "refresh_token":"8xLOxBtZp8",
       "key":"eyJhbGciOiJSU0ExXzUi ...
        (remainder of plain JWK omitted for brevity)"
     }
now IMHO this is a bird odd cause 
access_token":"SlAV32hkKG ...
        (remainder of JWT omitted for brevity;
        JWT contains JWK in the cnf claim)
so either is not a JWT and "remainder of JWT omitted… should be removed or SlAV32hkKG should look like a JWT (and it is not the case at the moment :))

regards

antonio

[0] https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-00#section-4.2

[OAUTH-WG] OAuth 2.0 Proof-of-Possession: Authori… Antonio Sanso
Re: [OAUTH-WG] OAuth 2.0 Proof-of-Possession: Aut… Justin Richer