Re: [OAUTH-WG] DPoP JWT claims

[Brian Campbell <[e-mail]>]

Yes, the change controller for "nonce" is the OpenID Foundation's Connect
Working Group (called Artifact Binding Working Group for historical reasons
https://www.iana.org/assignments/jwt/jwt.xhtml). But I don't think there
would be any resistance to an update because it's all basically the same
people involved. Mike, who proposed continued use of nonce with a registry
update from an OIDC errata in the github thread linked previously, is a
co-chair of that OIDF WG. I was just asking/suggesting that the update come
from this DPoP draft so that it might happen more expediently (if at all)
because this OIDC errata version is slow in coming and I suspect the
registry update had been forgotten.




On Tue, Jun 21, 2022 at 8:59 PM Benjamin Kaduk <[e-mail]> wrote:

> On Thu, Jun 16, 2022 at 04:18:49PM -0600, Brian Campbell wrote:
> > I'm not sure the JWT claims registry has turned out to be exactly what
> was
> > envisioned. And, to your point, the utility of some of the registrations
> is
> > questionable. The issue of name conflicts vs reuse is more subtle than it
>
> > seems. And practically speaking the registry is kind of the only way to
> > legitimately get/use a short claim name (so called private claim names
> > aren't ideal and arguably not appropriate for a prospective spec).
>
> This is probably the main reason I'm still in favor of registering short
> claim names -- people are going to want to use them and it's better to have
> most things in the registry than to have completely independent siloed
> usage.
>
> > There was some sort of related discussion with an AD a while back
> >
> https://mailarchive.ietf.org/arch/msg/jwt-reg-review/O4rmJbMOZZFbi6mlVk6VHp-xUs8/
> > that basically resulted in "just go ahead and register stuff". At least
> > that was my takeaway.
>
> I think we both (at the time) thought that it's better to have (registered)
> claim names that reflect the specificity of expected usage.  We can't
> always have nice things, though (case in point: all the existing
> registrations), and we're not going to "keep the registry pure" in whatever
> sense by pushing back hard on new registrations.  So that's how we end up
> in practice with "go ahead and register stuff", though we can certainly ask
> people if they want a more-specific name.
>
> > FWIW there was also some discussion around those very questions with
> > respect to "nonce" (see
> > https://github.com/danielfett/draft-dpop/pull/81#discussion_r713354503
> and
> > maybe a few comments back) with some push-back on using it. But the
> outcome
> > was to go ahead with nonce but also update the registry via a OIDC
> errata.
> > Though I suspect that action got lost in the shuffle. Maybe DPoP should
> do
> > it?
>
> I do have some general unease about reusing the claim (name) for a
> different meaning/usage without updating the registry in some manner.
> Consult a current AD for an authoritative reference, but I expect that OIDC
> has some form of "change control" over the existing registration and would
> need to be involved in some form if this change is made.
>
> As another data point, over in draft-ietf-ace-oauth-authz I made people
> create a new "cnonce" claim instead of reusing the existing "nonce" (also
> as claimed by OIDC).
>
> -Ben
>
> > On Thu, Jun 16, 2022 at 3:33 PM Neil Madden <[e-mail]>
> > wrote:
> >
> > > Is that actually true? The DPoP spec itself is a case in point: it
> reuses
> > > the existing OIDC “nonce” claim but explicitly says that DPoP nonces
> are
> > > not like OIDC nonces (section 9):
> > >
> > > “ Developers should also take care to not
> > >
> > >    confuse DPoP nonces with the OpenID Connect [OpenID.Core <
> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#ref-OpenID.Core>]
> ID Token
> > >    nonce.”
> > >
> > >
> > > The official IANA registration of “nonce” says:
> > >
> > >
> > > Value used to associate a Client session with an ID Token
> > >
> > >
> > > Does this matter? If not, does it matter if some other spec defines a
> “htm” claim with different meaning?
> > >
> > >
> > > On 16 Jun 2022, at 20:50, Dick Hardt <[e-mail]> wrote:
> > >
> > > 
> > > Registering the names provides clarity on use and avoids confusion on
> the
> > > meaning of a claim — ie two specs won’t have conflicting definitions of
> > > “htm”
> > >
> > > On Thu, Jun 16, 2022 at 10:20 AM Warren Parad <wparad=
> > > [e-mail]> wrote:
> > >
> > >> I think the registration really helps with discovery, especially as an
> > >> implementer. When you see or observe these claims in a JWT, you can
> google
> > >> them potentially returning no results. If you know about the IANA
> registry
> > >> you can find them, even if you don't know that the tokens have
> anything to
> > >> do with DPoP.
> > >>
> > >> On Thu, Jun 16, 2022 at 6:21 PM Neil Madden <
> [e-mail]>
> > >> wrote:
> > >>
> > >>> The DPoP spec registers the “htm”, “htu”, and “ath” claims [1]. But
> do
> > >>> these claims actually make sense outside of a DPoP proof? Presumably
> the
> > >>> risk of naming collision within a DPoP proof is pretty small, so is
> there
> > >>> any benefit to registering them rather than just using them as
> private
> > >>> claims?
> > >>>
> > >>> (I guess I could ask the same question about lots of other entries in
> > >>> the current registry at IANA, many of which look completely
> app-specific to
> > >>> me).
> > >>>
> > >>> [1]:
> > >>>
> https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop#section-12.7
> > >>>
> > >>>
> > >>> — Neil
> > >>> _______________________________________________
> > >>> OAuth mailing list
> > >>> [e-mail]
> > >>> https://www.ietf.org/mailman/listinfo/oauth
> > >>>
> > >> _______________________________________________
> > >> OAuth mailing list
> > >> [e-mail]
> > >> https://www.ietf.org/mailman/listinfo/oauth
> > >>
> > > _______________________________________________
> > > OAuth mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/oauth
> > >
> >
> > --
> > _CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged
> > material for the sole use of the intended recipient(s). Any review, use,
> > distribution or disclosure by others is strictly prohibited.  If you
> have
> > received this communication in error, please notify the sender
> immediately
> > by e-mail and delete the message and any file attachments from your
> > computer. Thank you._
>
> > _______________________________________________
> > OAuth mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/oauth
>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._