Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00)

William Denniss <wdenniss@google.com> Tue, 26 January 2016 00:08 UTC

Return-Path: <wdenniss@google.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2FF71A895C for <oauth@ietfa.amsl.com>; Mon, 25 Jan 2016 16:08:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.379
X-Spam-Level:
X-Spam-Status: No, score=-1.379 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UweQ4jblPzpo for <oauth@ietfa.amsl.com>; Mon, 25 Jan 2016 16:08:57 -0800 (PST)
Received: from mail-ob0-x231.google.com (mail-ob0-x231.google.com [IPv6:2607:f8b0:4003:c01::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 335311A8958 for <oauth@ietf.org>; Mon, 25 Jan 2016 16:08:56 -0800 (PST)
Received: by mail-ob0-x231.google.com with SMTP id zv1so29391772obb.2 for <oauth@ietf.org>; Mon, 25 Jan 2016 16:08:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=Wa4qvacl2X4Z4OVQMgmSMjeQzvMw8n3qpFw7AtEpSVg=; b=jHTIIEuBEvYJFabyg59Lnw2AR+8gu8xRuqSRkbJP4OhyzjWfjNHCoTyNfjtjFDzemZ W0Q8hdQiDKFDJW2Me+opuvU/8d2KmBBv9gjZRdY3PhLF/zeoJUgx3Fp0fwIMv+nPY88Q 5xDxDyHUFmR8LF341wd2k2q69KG/mkFZndLlFUq0z6BnQCEKEl8ornaf+kz8qCagajLa STbNktBNNyNrOtfxTpM+NwQOX5f/M9lHVs5wafCdz1NjFJiNAkt1lcphihCRDYaBlL+l JPyX0UlAPLkFqNHdRXCLNc19gChc9m3el7DJfznFD/wdhGRvbAr5B2Rv2kw2gu1FZ3xq /3dA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=Wa4qvacl2X4Z4OVQMgmSMjeQzvMw8n3qpFw7AtEpSVg=; b=iC2tga3I4IRQE1k27NNewOfYOmqFZvrRa8k6YexN+43ZlP2Fa5F0f6/PdseW11G4Ua LUEC8UKy96Z+oC8QB8DdqToDRSL7JcBwrGH5u7Sm7BYTV8ANTwosnsLRV/vR9+GNWHFv zy40Lhz750iSTzGJvfvWwgBASh9UjagSd0Zk17dqd8VWgQQMcHG7n2YZLvZIEFhgwUK2 4jffsuM2Y83q2QTo33pNX90uinbRs8a1VYRQPxvJYfNZvw+8/7c/BdAKdWqBNYDu+WdH 2oqO5+Ojb9jKiCOPUUAFrrKrToRmEN7phB4izVpvbvU+uGYKelJlqYsr7o3CnK0s4kP6 pZaA==
X-Gm-Message-State: AG10YOQ8nSIeW38l0IeHqY5kQrgOGsHTjPQkAfjYOYEjcpRviGAWMIzlTutwFXRmpMs43kocc3i3yQ5Qk6d7+19K
X-Received: by 10.60.67.34 with SMTP id k2mr15562363oet.67.1453766936221; Mon, 25 Jan 2016 16:08:56 -0800 (PST)
MIME-Version: 1.0
Received: by 10.182.227.39 with HTTP; Mon, 25 Jan 2016 16:08:36 -0800 (PST)
In-Reply-To: <BY2PR03MB44214DF2BDECA8050E819F6F5C70@BY2PR03MB442.namprd03.prod.outlook.com>
References: <568D24DD.3050501@connect2id.com> <EA392E73-1C01-42DC-B21D-09F570239D5E@ve7jtb.com> <CAAP42hAA6SOvfxjfuQdjoPfSh3HmK=a7PCQ_sPXTmDg+AQ6sug@mail.gmail.com> <568D5610.6000506@lodderstedt.net> <CAAP42hA8SyOOkJ-D299VgvQUdQv6NXqxSt9R0TK7Zk7JaU56eQ@mail.gmail.com> <F9C0DF10-C067-4EEB-85C8-E1208798EA54@gmail.com> <CABzCy2A+Z86UCJXeK1mLPfyq9p1QQS=_dekbEz6ibP8Z8Pz87Q@mail.gmail.com> <CAAP42hCKRpEnS7zVL7C_jpaFXwXUjzkNUzxtDa9MUKAQw7gsAA@mail.gmail.com> <10631235-AF1B-4122-AEAE-D56BBF38F87E@ve7jtb.com> <CAAP42hB=1rudPCzrCgaUp3W8+K0jcfoAwq3gJG5=vNeK9pqjaA@mail.gmail.com> <6F32C1CF-EA2A-4A74-A694-F52FD19DBA5C@ve7jtb.com> <CAAP42hC1KbDF1oOLyY11ZBW-WyBQjaEQTzAyZLfKUvOS8fOQOQ@mail.gmail.com> <BY2PR03MB44214DF2BDECA8050E819F6F5C70@BY2PR03MB442.namprd03.prod.outlook.com>
From: William Denniss <wdenniss@google.com>
Date: Mon, 25 Jan 2016 16:08:36 -0800
Message-ID: <CAAP42hDSWPq+wdjEk1D=rFeUuccpc3rQbxJmAR2TS0sjVahA-w@mail.gmail.com>
To: Mike Jones <Michael.Jones@microsoft.com>
Content-Type: multipart/alternative; boundary=001a11c2e298d21ab4052a317d77
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/h3IqVz8p1InWAg3b310QSTExeYg>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery (draft-jones-oauth-discovery-00)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jan 2016 00:08:59 -0000

Thanks Mike, looking forward to the update. I reviewed the other thread.

On Mon, Jan 25, 2016 at 2:49 PM, Mike Jones <Michael.Jones@microsoft.com>;
wrote:

> I'll add it to the discovery draft in the next day or so.  Also, please
> see my questions in the message "[OAUTH-WG] Discovery document updates
> planned". I was waiting for that feedback before doing the update.
>
> Thanks,
> -- Mike
> ------------------------------
> From: William Denniss <wdenniss@google.com>;
> Sent: ‎1/‎25/‎2016 2:29 PM
> To: John Bradley <ve7jtb@ve7jtb.com>;
> Cc: Nat Sakimura <sakimura@gmail.com>;; oauth@ietf.org; Mike Jones
> <Michael.Jones@microsoft.com>;
> Subject: Re: [OAUTH-WG] Advertise PKCE support in OAuth 2.0 Discovery
> (draft-jones-oauth-discovery-00)
>
> OK great! It seems that we have consensus on this. So this is what we plan
> to add to our discovery doc, based on this discussion:
>
> "code_challenge_methods_supported": ["plain","S256"]
>
> What are the next steps? Can we we add it to
> https://tools.ietf.org/html/draft-jones-oauth-discovery directly? I see
> that the IANA registry created by that draft is "Specification Required",
> but PKCE is already an RFC without this param being registered.
>
>
> On Mon, Jan 25, 2016 at 2:11 PM, John Bradley <ve7jtb@ve7jtb.com>; wrote:
>
>> Yes sorry.   code_challenge_method is the query parameter so
>> code_challenge_methods_supported
>>
>>
>> On Jan 25, 2016, at 6:12 PM, William Denniss <wdenniss@google.com>; wrote:
>>
>>
>>
>> On Thu, Jan 21, 2016 at 6:17 AM, John Bradley <ve7jtb@ve7jtb.com>; wrote:
>>
>>> The code_challenge and code_challenge_method parameter names predate
>>> calling the spec PKCE.
>>>
>>> Given that some of us deployed early versions of PKCE in products and
>>> opensource to mitigate the problem before the spec was completed we decided
>>> not to rename the parameter names from code_verifier_method to
>>> pkce_verifier_method.
>>>
>>> For consistency we should stick with code_verifier_methods_supported in
>>> discovery.
>>>
>>
>> To clarify, did you mean "code_challenge_methods_supported"?  That is,
>> building on the param name "code_challenge_method" from Section 4.3
>> <https://tools.ietf.org/html/rfc7636#section-4.3>?
>>
>>
>>>
>>> John B.
>>>
>>> On Jan 21, 2016, at 3:12 AM, William Denniss <wdenniss@google.com>;
>>> wrote:
>>>
>>> "code_challenge_methods_supported" definitely works for me.
>>>
>>> Any objections to moving forward with that? I would like to update our
>>> discovery doc shortly.
>>>
>>> On Thu, Jan 21, 2016 at 1:37 PM, Nat Sakimura <sakimura@gmail.com>;
>>> wrote:
>>>
>>>> Ah, OK. That's actually reasonable.
>>>>
>>>> 2016年1月21日(木) 9:31 nov matake <matake@gmail.com>;:
>>>>
>>>>> I prefer “code_challenge_methods_supported”, since the registered
>>>>> parameter name is “code_challenge_method”, not “pkce_method".
>>>>>
>>>>> On Jan 19, 2016, at 11:58, William Denniss <wdenniss@google.com>;
>>>>> wrote:
>>>>>
>>>>> Seems like we agree this should be added. How should it look?
>>>>>
>>>>> Two ideas:
>>>>>
>>>>> "code_challenge_methods_supported": ["plain", "S256"]
>>>>>
>>>>> or
>>>>>
>>>>> "pkce_methods_supported": ["plain", "S256"]
>>>>>
>>>>>
>>>>>
>>>>> On Wed, Jan 6, 2016 at 9:59 AM, Torsten Lodderstedt <
>>>>> torsten@lodderstedt.net>; wrote:
>>>>>
>>>>>> +1
>>>>>>
>>>>>>
>>>>>> Am 06.01.2016 um 18:25 schrieb William Denniss:
>>>>>>
>>>>>> +1
>>>>>>
>>>>>> On Wed, Jan 6, 2016 at 6:40 AM, John Bradley <ve7jtb@ve7jtb.com>;
>>>>>> wrote:
>>>>>>
>>>>>>> Good point.  Now that PKCE is a RFC we should add it to discovery.
>>>>>>>
>>>>>>> John B.
>>>>>>> > On Jan 6, 2016, at 9:29 AM, Vladimir Dzhuvinov <
>>>>>>> vladimir@connect2id.com>; wrote:
>>>>>>> >
>>>>>>> > I just noticed PKCE support is missing from the discovery metadata.
>>>>>>> >
>>>>>>> > Is it a good idea to add it?
>>>>>>> >
>>>>>>> > Cheers,
>>>>>>> >
>>>>>>> > Vladimir
>>>>>>> >
>>>>>>> > --
>>>>>>> > Vladimir Dzhuvinov
>>>>>>> >
>>>>>>> >
>>>>>>> > _______________________________________________
>>>>>>> > OAuth mailing list
>>>>>>> > OAuth@ietf.org
>>>>>>> > https://www.ietf.org/mailman/listinfo/oauth
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> OAuth mailing list
>>>>>>> OAuth@ietf.org
>>>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> OAuth mailing listOAuth@ietf.orghttps://www.ietf.org/mailman/listinfo/oauth
>>>>>>
>>>>>>
>>>>>>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> OAuth@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> OAuth@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>>
>>>>
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>>>
>>>
>>>
>>
>>
>