Re: [OAUTH-WG] JWT binding for OAuth 2.0

[Hannes Tschofenig <[e-mail]>]

Although I am not a huge fan of SOAP feel free to write a document and
make it available to the group so that we can look at the details.

On 04/15/2015 01:30 PM, Prabath Siriwardena wrote:
> Hi Hannes,
> 
> I still think its equally important to have a transport independent
> binding ..
> 
> If you look at the SOAP world, WS-Security is self-contained in the
> message itself.. and SAML SOAP binding is also another example...
> 
> Thanks & regards,
> -Prabath
> 
> 
> On Wed, Apr 15, 2015 at 1:16 AM, Hannes Tschofenig
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     Hi Prabath,
> 
>     the reason we have documents that describe the transport of bearer
>     tokens/proof-of-possession tokens over the different transports is a
>     task is more than just conveying a JWT over some protocol.
> 
>     There are various documents that specify the transport of OAuth access
>     tokens over some protocol:
> 
>     * Bearer Tokens over HTTPS:
>     https://tools.ietf.org/html/rfc6750
> 
>     * Proof-of-Possession Tokens over TURN
>     http://tools.ietf.org/html/draft-ietf-tram-turn-third-party-authz-13
> 
>     * Bearer Tokens over SASL:
>     https://tools.ietf.org/html/draft-ietf-kitten-sasl-oauth-19
> 
>     * Bearer Tokens over CoAP:
>     https://tools.ietf.org/html/draft-tschofenig-ace-oauth-bt-01
> 
>     * OAuth over SIP:
>     https://tools.ietf.org/html/draft-yusef-sipcore-sip-oauth-02
> 
>     * Then, there is all the work on proof-of-possession tokens that
>     requires thoughts on how to tie the access token to the request (see
>     http://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-01 or
>     token binding at
>     https://tools.ietf.org/html/draft-ietf-tokbind-protocol-00)
> 
>     If you look at these documents then you will see that the
>     characteristics of the underlying protocol matter a lot from a security
>     point of view. There are also encoding and discovery related aspects
>     that need to be taken into account as well.
> 
>     If someone wants to figure out how to carry OAuth access tokens over
>     MQTT then they will have to figure out whether there are some additional
>     considerations to take into account.
> 
>     What we should probably doing in this group is to write a guidance
>     document for using OAuth over <<foo>>.
> 
>     Ciao
>     Hannes
> 
>     On 04/15/2015 12:02 AM, Prabath Siriwardena wrote:
>     > It can be a JSON payload over JMS or even MQTT..
>     >
>     > I have seen some effort to create an MQTT binding for OAuth 2.0 - but
>     > then again for each transport we need to have a binding..
>     >
>     > But - creating a message level binding would be much better IMHO..
>     >
>     > Thanks & regards,
>     > -Prabath
>     >
>     > On Tue, Apr 14, 2015 at 2:55 PM, John Bradley <[e-mail] <mailto:[e-mail]>
>     > <mailto:[e-mail] <mailto:[e-mail]>>> wrote:
>     >
>     >     Most of the pub sub things I have seen use HTTP transport.  Do you
>     >     have a pointer to the protocol?
>     >
>     >>     On Apr 14, 2015, at 6:48 PM, Prabath Siriwardena <[e-mail] <mailto:[e-mail]>
>     >>     <mailto:[e-mail] <mailto:[e-mail]>>> wrote:
>     >>
>     >>     Thanks John for the pointer - will have look..
>     >>
>     >>     I am looking this for a pub/sub scenario..  Having JWT binding
>     >>     would benefit that..
>     >>
>     >>     Also - why I want access token to be inside a JWT is - when we
>     >>     send a JSON payload in this case, we already have the JWT envelope
>     >>     and the access token needs to be carried inside..
>     >>
>     >>     Thanks & regards,
>     >>     -Prabath
>     >>
>     >>
>     >>
>     >>
>     >>
>     >>     On Tue, Apr 14, 2015 at 2:41 PM, John Bradley <[e-mail] <mailto:[e-mail]>
>     >>     <mailto:[e-mail] <mailto:[e-mail]>>> wrote:
>     >>
>     >>         There is a OAuth binding to
>     >>         SASL https://tools.ietf.org/html/draft-ietf-kitten-sasl-oauth-19
>     >>
>     >>         Google supports it for IMAP/SMTP,  I think the latest iOS and
>     >>         OSX mail client updates use it rather than passwords for Google.
>     >>         I also noticed Outlook on Android using it.
>     >>
>     >>         The access token might be a signed or encrypted JWT itself.  I
>     >>         don’t know that wrapping it again necessarily helps.
>     >>
>     >>         Yes we should have bindings to other non http protocols.
>     >>
>     >>         Is there something specific that you are looking for that is
>     >>         not covered by SASL?
>     >>
>     >>         John B.
>     >>
>     >>
>     >>
>     >>>         On Apr 14, 2015, at 6:21 PM, Prabath Siriwardena
>     >>>         <[e-mail] <mailto:[e-mail]> <mailto:[e-mail]
>     <mailto:[e-mail]>>> wrote:
>     >>>
>     >>>         At the moment we only HTTP binding to transport the access
>     >>>         token (please correct me if not)..
>     >>>
>     >>>         This creates a dependency on the transport.
>     >>>
>     >>>         How about creating a JWT binding for OAuth 2.0..? We can
>     >>>         transport the access token as an encrypted JWT header
>     >>>         parameter..?
>     >>>
>     >>>
>     >>>         Thanks & Regards,
>     >>>         Prabath
>     >>>
>     >>>         Twitter : @prabath
>     >>>         LinkedIn : http://www.linkedin.com/in/prabathsiriwardena
>     >>>
>     >>>         Mobile : [phone] <tel:%2B1%20650%20625%207950>
>     <tel:%2B1%20650%20625%207950>
>     >>>
>     >>>         http://blog.facilelogin.com <http://blog.facilelogin.com/>
>     >>>         http://blog.api-security.org <http://blog.api-security.org/>
>     >>>         _______________________________________________
>     >>>         OAuth mailing list
>     >>>         [e-mail] <mailto:[e-mail]>
>     <mailto:[e-mail] <mailto:[e-mail]>>
>     >>>         https://www.ietf.org/mailman/listinfo/oauth
>     >>
>     >>
>     >>
>     >>
>     >>     --
>     >>     Thanks & Regards,
>     >>     Prabath
>     >>
>     >>     Twitter : @prabath
>     >>     LinkedIn : http://www.linkedin.com/in/prabathsiriwardena
>     >>
>     >>     Mobile : [phone] <tel:%2B1%20650%20625%207950>
>     <tel:%2B1%20650%20625%207950>
>     >>
>     >>     http://blog.facilelogin.com <http://blog.facilelogin.com/>
>     >>     http://blog.api-security.org <http://blog.api-security.org/>
>     >
>     >
>     >
>     >
>     > --
>     > Thanks & Regards,
>     > Prabath
>     >
>     > Twitter : @prabath
>     > LinkedIn : http://www.linkedin.com/in/prabathsiriwardena
>     >
>     > Mobile : [phone] <tel:%2B1%20650%20625%207950>
>     >
>     > http://blog.facilelogin.com
>     > http://blog.api-security.org
>     >
>     >
>     > _______________________________________________
>     > OAuth mailing list
>     > [e-mail] <mailto:[e-mail]>
>     > https://www.ietf.org/mailman/listinfo/oauth
>     >
> 
> 
> 
> 
> -- 
> Thanks & Regards,
> Prabath
> 
> Twitter : @prabath
> LinkedIn : http://www.linkedin.com/in/prabathsiriwardena
> 
> Mobile : [phone]
> 
> http://blog.facilelogin.com
> http://blog.api-security.org