Re: [OAUTH-WG] Adam Roach's Discuss on draft-ietf-oauth-jwt-introspection-response-07: (with DISCUSS and COMMENT)

Torsten Lodderstedt <torsten@lodderstedt.net> Fri, 20 September 2019 13:12 UTC

Return-Path: <torsten@lodderstedt.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE83D1200DB; Fri, 20 Sep 2019 06:12:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.62
X-Spam-Level:
X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M44A4C8rNyqu; Fri, 20 Sep 2019 06:12:12 -0700 (PDT)
Received: from smtprelay04.ispgateway.de (smtprelay04.ispgateway.de [80.67.18.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF1B612003F; Fri, 20 Sep 2019 06:12:11 -0700 (PDT)
Received: from [91.13.158.20] (helo=[192.168.71.123]) by smtprelay04.ispgateway.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92.2) (envelope-from <torsten@lodderstedt.net>) id 1iBIhl-0007ED-01; Fri, 20 Sep 2019 15:12:09 +0200
From: Torsten Lodderstedt <torsten@lodderstedt.net>
Message-Id: <85F5FCA2-A540-468E-B8E6-3080172C2B55@lodderstedt.net>
Content-Type: multipart/signed; boundary="Apple-Mail=_60FE12CF-53B9-4757-9C2B-E9F81C81A29A"; protocol="application/pkcs7-signature"; micalg=sha-256
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Date: Fri, 20 Sep 2019 15:12:08 +0200
In-Reply-To: <156758306119.22796.7625113709709674898.idtracker@ietfa.amsl.com>
Cc: The IESG <iesg@ietf.org>, oauth@ietf.org, draft-ietf-oauth-jwt-introspection-response@ietf.org, oauth-chairs@ietf.org
To: Adam Roach <adam@nostrum.com>
References: <156758306119.22796.7625113709709674898.idtracker@ietfa.amsl.com>
X-Mailer: Apple Mail (2.3445.104.11)
X-Df-Sender: dG9yc3RlbkBsb2RkZXJzdGVkdC5uZXQ=
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/esH0MGvBXTNuc5qe3BDGz0EPm5o>
Subject: Re: [OAUTH-WG] Adam Roach's Discuss on draft-ietf-oauth-jwt-introspection-response-07: (with DISCUSS and COMMENT)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Sep 2019 13:12:14 -0000

Hi Adam, 

thank your for your review. 

We just published https://tools.ietf.org/html/draft-ietf-oauth-jwt-introspection-response-08 that hopefully resolves your DISCUSS and COMMENT.

> On 4. Sep 2019, at 09:44, Adam Roach via Datatracker <noreply@ietf.org> wrote:
> 
> Adam Roach has entered the following ballot position for
> draft-ietf-oauth-jwt-introspection-response-07: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-introspection-response/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Thanks for the work the authors and other contributors have
> put into creating this document.
> 
> I have a privacy concern that I think warrants text in the document.
> 
> Section 8.3.1 introduces a significant amount of personally-identifiable
> information. While I understand that this is needed for the use case
> cited in the introduction (issuing certificated for electronic signatures),
> I think the document needs some treatment of the sensitivity of this
> information, the basis that the server uses to decide whether to include
> it, and how consent to disclose it might be obtained from the user.

We added text about the trust management between AS and RS and how an AS determines what data a RS is allowed to receive (Sections 3 and 5). 

We also re-reworked the Privacy Considerations section and added text about prerequisites for personal data transfer between AS and RS and security requirements in this context. 

> 
> I'm putting this in as a DISCUSS, because I really do think this is
> a showstopper for publication. I am quite aware, however, that I might
> simply be missing some important aspect of the solution that makes my
> concerns moot. Please point me in the right direction if this is the
> case, and I'll be happy to clear.

We had some assumptions (just) in mind that we now added to the document. I hope this clears your DISCUSS.

> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> §3:
> 
>> The example response contains the following JSON document:
>> 
>> {
>>   "sub": "Z5O3upPC88QrAjx00dis",
>>   "aud": "https://protected.example.net/resource",
>>   "scope": "read write dolphin",
>>   "iss": "https://server.example.com/",
>>   "active": true,
>>   "exp": 1419356238,
>>   "iat": 1419350238,
>>   "client_id": "l238j323ds-23ij4",
>>   "given_name": "John",
>>   "family_name":"Doe",
>>   "birthdate":"1982-02-01"
>> }
> 
> The example response actually contains the following JSON document:
> 
> {
>   "sub":"Z5O3upPC88QrAjx00dis",
>   "aud":"https:\/\/protected.example.net\/resource",
>   "extension_field":"twenty-seven",
>   "scope":"read write dolphin",
>   "iss":"https:\/\/server.example.com\/",
>   "active":true,
>   "exp":1419356238,
>   "iat":1419350238,
>   "client_id":"l238j323ds-23ij4",
>   "username":"jdoe"
> }
> 
> Note the presence of "extension_field" and "username" fields, and the
> absence of "given_name", "family_name", and "birthdate" fields. There's
> also a bunch of unnecessarily escaped "/" characters in the document
> in the JWT, but not the expanded example; and while these are semantically
> insignificant, the discrepancy seems gratuitous.
> 
> It is probably worthwhile updating either the JWT or the expanded
> example so that they match.

We re-did the whole example. 

best regards.
Torsten. 

> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth