From sachinmamoru@gmail.com Tue Feb 20 03:02:22 2024 Return-Path: X-Original-To: oauth@ietfa.amsl.com Delivered-To: oauth@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0903C14F69F for ; Tue, 20 Feb 2024 03:02:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.084 X-Spam-Level: X-Spam-Status: No, score=-7.084 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_REMOTE_IMAGE=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FHywvPiCy0aE for ; Tue, 20 Feb 2024 03:02:18 -0800 (PST) Received: from mail-yb1-xb32.google.com (mail-yb1-xb32.google.com [IPv6:2607:f8b0:4864:20::b32]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40177C14F5FE for ; Tue, 20 Feb 2024 03:02:18 -0800 (PST) Received: by mail-yb1-xb32.google.com with SMTP id 3f1490d57ef6-dc74e33fe1bso4978864276.0 for ; Tue, 20 Feb 2024 03:02:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708426937; x=1709031737; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=w+7zMgqAyItCacZ+rpWVckCpMdva7AECksFuO3v/2yo=; b=lDf/V2MfIXWzTvwx2laWJqM17H16ZG/Z78wzncby27X/sVhNqFwbIXxPgQV/PQZrVT Zn/4Kp67zmBE4rnjm/0JDL5oGjqemgy/Bh4aVVc+7iYNVhorvU19TWOqzIvRJ6jzJ/Ji Zc1AWqR2MNP6co9Z8TuWSnUQvI/yNHHdsonimG497wpSHs2LV2uUtnTnuFZkYhsY2yDN 528NCU3FLgSGWKcmIz5AEsDtLN9UsL9vXpxP9hpa1Z2OWVt+1P2twjh0G8uwci7Xm3Rt k3XdFv4l51I2EiRGbwztSKmUG6kHgjtZnp8V8p9H9PytHKHdb5Tp0jcSbbav3f/bQijS BJaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708426937; x=1709031737; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=w+7zMgqAyItCacZ+rpWVckCpMdva7AECksFuO3v/2yo=; b=pGKWP1NL6M+8Dv4Rke5AnzntKLY2JNitqRMa8yKRAvp9S5EgfY27juP6JyGRa6/Vgi k9uB1x/3n5+iw+RrmyPmR34K5Dcr7vPZe/JXC8UurdLuFZXfrMk7eYj1XsJSGZlfF3OZ qLQFc/fROAQ0IoQF+KqfHGIao/LY+u3WxD2J2vlGjDW5wAh0eL3Ho4Kv6fI9jEwejIgO YEHMKW3RfJOMzhKfZjTfMqqgV0xdYJXNsdKR16W1WCq+7yLmvAk5ivHObLqOdtY53p4o n53eUUve6lubdQ5/6hERPIqR+ZDQ1W8yZ8Lipb+sDd0SQ4WldRAkuUCssodLi0DhU061 WdRQ== X-Gm-Message-State: AOJu0YwuWKefdooYsk8PsqDQBl1tARgaAnMJVj0qV8LQbXownIbmopPk Pev1PzTf4aHduQ2x/jYP3q9dy6sUUGX/G/APDLwi1qmMYyhyXShUERrME7HyLYqU2buQ2gmKvZP W/ekN63fvPb5M3CzngL7fu5cwUU0= X-Google-Smtp-Source: AGHT+IFdWaOP3IH6QvWfpQyp4TjULN4S6yXWD9q8fPfs4LLw+dWblnzHiG2uwQ8eEDnH+HA9uLQ/LLy0nMYyBPj1ZQk= X-Received: by 2002:a05:6902:1b86:b0:dcc:1449:71ea with SMTP id ei6-20020a0569021b8600b00dcc144971eamr12893694ybb.50.1708426936975; Tue, 20 Feb 2024 03:02:16 -0800 (PST) MIME-Version: 1.0 References: <9D9E6142-0C87-4140-BB9F-AE3B89A44BCB@gmail.com> In-Reply-To: From: Sachin Mamoru Date: Tue, 20 Feb 2024 16:32:05 +0530 Message-ID: To: Neil Madden Cc: oauth@ietf.org, janak@wso2.com, thilinasenarath97@gmail.com Content-Type: multipart/alternative; boundary="000000000000b407830611ce2413" Archived-At: Subject: Re: [OAUTH-WG] Evaluation of Scope Management in Refresh Token Behavior X-BeenThere: oauth@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: OAUTH WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Feb 2024 11:02:23 -0000 --000000000000b407830611ce2413 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Neil, Does that mean it should be identical to the narrowed scope request or the original request scope? On Tue, 20 Feb 2024 at 16:31, Sachin Mamoru wrote: > > > On Tue, 20 Feb 2024 at 12:23, Neil Madden wrote= : > >> >> On 20 Feb 2024, at 06:44, Sachin Mamoru wrote: >> >> =EF=BB=BF >> Hi All, >> >> When we request an access token using 3 scopes (scope1, scope2, scope3). >> >> Then will receive a refresh token (refresh_token1) with the access token= . >> >> After that will request another access token with refresh_token1 and >> provide the scope list as scope1 and scope2 (Narrow down scopes). >> >> Similarly, get another refresh token (refresh_token2) with the access >> token. >> >> Now if we request another access token with refresh_token2, we cannot >> request scope3, instead, we can either request both scope1 and scope2 or >> one of them. >> >> But in the specification, didn't able to find anything related to >> narrow-down scopes with refresh token. >> >> From Spec >> >> 1.5. Refresh Token - Refresh tokens are issued to the client by the >> authorization server and are used to obtain a new access token when the >> current access token becomes invalid or expires or to obtain additional >> access tokens with identical or narrower scope (access tokens may have a >> shorter lifetime and fewer permissions than authorized by the resource >> owner). >> >> 6. Refreshing an Access Token >> >> The scope of the access request as described by Section 3.3. The >> requested scope MUST NOT include any scope not originally granted by the >> resource owner, and if omitted is treated as equal to the scope >> originally granted by the resource owner. >> >> https://datatracker.ietf.org/doc/html/rfc6749 >> >> >> IMO, from a security aspect, the current behaviour is much more secure >> because it is designed to maintain the principle of least privilege, whe= re >> it updates the refresh token authorised scopes based on the requested on= es. >> >> >> What should be the correct behaviour? >> narrow-down scope refresh token should also be able to request access >> token with original scope list? >> >> >> Also from section 6: >> >> If a >> new refresh token is issued, the refresh token scope MUST be >> identical to that of the refresh token included by the client in the >> request. >> >> >> >> >> >> =E2=80=94 Neil >> >> > > -- > > Sachin Mamoru > Software Engineer, WSO2 > +94771292681 > | sachinmamoru.me > sachinmamoru@gmail.com > > > > --=20 Sachin Mamoru Software Engineer, WSO2 +94771292681 | sachinmamoru.me sachinmamoru@gmail.com --000000000000b407830611ce2413 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Neil,

Does that mean it should be id= entical to the narrowed scope request or the original request scope?
<= /div>
O= n Tue, 20 Feb 2024 at 16:31, Sachin Mamoru <sachinmamoru@gmail.com> wrote:


On Tue, 20 Feb 202= 4 at 12:23, Neil Madden <neil.e.madden@gmail.com> wrote:

On= 20 Feb 2024, at 06:44, Sachin Mamoru <sachinmamoru@gmail.com> wrote:

=EF=BB=BF
Hi All,

When we request an access token using 3 scopes (scope1,= scope2, scope3).

Then will receive a refresh token (refresh_token1) with t= he access token.


After that wil= l request another access token with refresh_token1 and provide the scope li= st as scope1 and scope2 (Narrow down scopes).

Similarly, get another refr= esh token (refresh_token2) with the access token.


Now if we request another access token with refresh_toke= n2, we cannot request scope3, instead, we can either request both scope1 an= d scope2 or one of them.


Bu= t in the specification, didn't able to find anything related to narrow-= down scopes with refresh token.


<= font face=3D"arial, sans-serif">From Spec


1.5.=C2=A0 Refresh Token -=C2=A0Refresh tokens are issued to the clien= t by the authorization server and are=C2=A0used to obtain a new access token when= the current access token=C2=A0becomes invalid or expires or to obtain additional= access tokens=C2=A0with identical or narrower scope (access tokens may have a sh= orter=C2=A0lifetime and fewer permissions than authorized by the resource=C2=A0owner).<= /span>


6.=C2=A0 Refreshing an Access T= oken

The scope of the access request as described by=C2=A0Section 3.3.=C2=A0 The = requested scope MUST NOT include any scope=C2=A0not originally granted by the res= ource owner, and if omitted is=C2=A0treated as equal to the scope originally gran= ted by the=C2=A0resource owner.


https://datatracker.ietf.org= /doc/html/rfc6749


=

IMO, from a security aspect, the= current behaviour is much more secure because it is designed to maintain t= he principle of least privilege, where it updates the refresh token authori= sed scopes based on the requested ones.


What should be the = correct behaviour?
narrow-down scope refresh token should also be able t= o request access token with original scope list?


Als= o from section 6:

If a
   new refresh token is issued, the refresh token scope MUST be
   identical to that of the refresh token included by the client in the
   request.
=




=E2=80=94 Neil
<= /div>


--
=C2=A0
Sachin Mamoru
Software Engineer, WSO2
+94771292681
| sachinmamoru.me=C2=A0<= /a>
sa= chinmamoru@gmail.com=C2=A0
<= table border=3D"0" cellpadding=3D"0" cellspacing=3D"0">
3D""


--
<= /table>
=C2=A0
Sachin Mamoru
Software Engineer, WSO2
=
+94771292681
| sachinmamoru.me=C2=A0<= /td>
sachin= mamoru@gmail.com=C2=A0
=

=3D""
--000000000000b407830611ce2413--