IETF Logo Mail Archive

Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint

Benjamin Kaduk <kaduk@mit.edu> Tue, 15 January 2019 04:09 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66126130D7A for <oauth@ietfa.amsl.com>; Mon, 14 Jan 2019 20:09:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mit.edu
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I0omNSRNephT for <oauth@ietfa.amsl.com>; Mon, 14 Jan 2019 20:09:52 -0800 (PST)
Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-eopbgr740103.outbound.protection.outlook.com [40.107.74.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C64E812F295 for <oauth@ietf.org>; Mon, 14 Jan 2019 20:09:51 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T7EIRBFRjCJFIbahL4S7Q8bTo40GM2I5OiS33WrZFV4=; b=Lpxs8WEYHfdpmzR3Zupof6LMsyl16KzRu1mL7Arx2Tr+AyhUP57m2dhrMt13U3wxN3IKtrfnxvTP6Q4CQnqa+YXgHQ8kFWgUL6RE4jQK4VurCeQfyZjzyGLrBGu+uJvfF9884FX9ugrVaHtRWEYqJge+vifwi+tBtPIxE55Zeq0=
Received: from DM5PR0101CA0036.prod.exchangelabs.com (2603:10b6:4:28::49) by BYAPR01MB5527.prod.exchangelabs.com (2603:10b6:a03:123::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1516.20; Tue, 15 Jan 2019 04:09:49 +0000
Received: from BY2NAM03FT054.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e4a::205) by DM5PR0101CA0036.outlook.office365.com (2603:10b6:4:28::49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1516.13 via Frontend Transport; Tue, 15 Jan 2019 04:09:49 +0000
Authentication-Results: spf=pass (sender IP is 18.9.28.11) smtp.mailfrom=mit.edu; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates 18.9.28.11 as permitted sender) receiver=protection.outlook.com; client-ip=18.9.28.11; helo=outgoing.mit.edu;
Received: from outgoing.mit.edu (18.9.28.11) by BY2NAM03FT054.mail.protection.outlook.com (10.152.85.30) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1471.13 via Frontend Transport; Tue, 15 Jan 2019 04:09:48 +0000
Received: from kduck.mit.edu (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x0F49ioa032288 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 14 Jan 2019 23:09:47 -0500
Date: Mon, 14 Jan 2019 22:09:44 -0600
From: Benjamin Kaduk <kaduk@mit.edu>
To: Brian Campbell <bcampbell=40pingidentity.com@dmarc.ietf.org>
CC: David Waite <david@alkaline-solutions.com>, oauth <oauth@ietf.org>
Message-ID: <20190115040943.GB18381@kduck.mit.edu>
References: <CA+k3eCTKSFiiTw8--qBS0R2YVQ0MY0eKrMBvBNE4pauSr1rHcA@mail.gmail.com> <6A614742-290D-47E2-B3E9-A4D49DB32DD7@forgerock.com> <CA+k3eCSoNRGrsxeLYd6DEqU+U6TB_aXV2aPUa07Um2X0ZH_ZEw@mail.gmail.com> <548FF68E-7775-4FE0-829F-1E9CC6EA8E3F@alkaline-solutions.com> <1119DDAE-8044-43C9-A6D4-6032B3BB62B8@forgerock.com> <9D007408-3BCC-4165-BCA4-083BD7602E7D@alkaline-solutions.com> <CA+k3eCQi1sz2bDOMEATpN9ZvXd+VJydQXG03WKuLczG5kz2z+Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CA+k3eCQi1sz2bDOMEATpN9ZvXd+VJydQXG03WKuLczG5kz2z+Q@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:18.9.28.11; IPV:CAL; SCL:-1; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(136003)(376002)(39860400002)(396003)(346002)(2980300002)(199004)(189003)(356004)(50466002)(6666004)(446003)(186003)(26005)(1076003)(4744005)(23726003)(229853002)(7696005)(75432002)(106466001)(47776003)(76176011)(336012)(104016004)(426003)(55016002)(97756001)(5660300001)(53416004)(86362001)(316002)(4326008)(786003)(11346002)(36906005)(46406003)(58126008)(54906003)(33656002)(476003)(16586007)(126002)(8676002)(246002)(305945005)(6246003)(2906002)(486006)(956004)(8936002)(478600001)(106002)(88552002)(26826003)(93886005)(18370500001); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR01MB5527; H:outgoing.mit.edu; FPR:; SPF:Pass; LANG:en; PTR:outgoing-auth-1.mit.edu; A:1; MX:1;
X-Microsoft-Exchange-Diagnostics: 1; BY2NAM03FT054; 1:3EkgRBfPWhtYkX1Pus6GoXUX5f6F75+crl0qrW5DqRx8b/sl25wyrGoPdMQtXXvFEndNiqdPbPOGDL9N0S/D1BYEvQfR1pPkT8a9NEzVcImciqkR/xi+x6pcKbJcMr2u
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 77ce6aa7-0754-44c3-2770-08d67a9f4acc
X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600109)(711020)(4608076)(4709027)(2017052603328)(7153060); SRVR:BYAPR01MB5527;
X-Microsoft-Exchange-Diagnostics: 1; BYAPR01MB5527; 3:8mCXagdkB41IBKYDge1YSfl7BC7FsYOgMNNOm0DSOllhedBDAtsB17CzffQZPfyOyD7nj/19D+HJCUUtyHXC2GmUvYREBsdfIVmfNkW5K4U6/NfViIhIoTHUyf5vY6cgFLOecErcGK5y4H5mEPy5RszIjx9oCv8dqaU2LHRC7XjV1P5UfZKgYN8xgfJkbn4I6//thVmt1lQnWPeCRZaFrBBWNPMZ1Fzl7pRV3Nzo7DfTXp0qha1G8sDdc5EhEaQab8A3KKMXiZdYfeFQm+oZoCjUL2DUY6UyzRtjJ2Z69j9Mv8YZBrxTIie0q3G9UofOp3G+GblzzLeQXURhNX4GCtIQZUXYPUKmTY2u7hMiiHeHKBrYpn82jc5ReKoKgrXp; 25:TEZiPb3mn24sgtY6kNTDql3g9qoVdKwYwaZ73ZaGzIoB5uFliNjbr4I9Iaa4wcmCl6ivOur0gWSFNf13FYC4Pi/33Q/eoDGO+k52bIuKEhM50xlctlifmV+qaZOdD0tmUZWnTKnolVsga6lyp0DleVISq7go7C33qYQcz4lae16KLwaCfGRQ/EwSJqKQ/6H1jo8gBjElPjwGGywABCaiKlPVgJcR+cY0V+/rqe8u5I0ifWqGWULKn4RwasWQ4VKK7S6gFWHo71RUrEV+Vi21DIc8RB4SPTb5hFMhSXLr9ugwh6JXAImYyjWuLE2qIdigDD4SusCBdWQZvnNR7ITMzw==
X-MS-TrafficTypeDiagnostic: BYAPR01MB5527:
X-Microsoft-Exchange-Diagnostics: 1; BYAPR01MB5527; 31:iuy228ktv/hpBv8NHvosSp+dBxa4lHFtuwKfVyQmxaOtpNXC+ATcaSCCjqSZwA0xHNKAWicvNPVrjePUb4JNHsHhEhSzV9THwF21aakw1oMyz6E8Q78/yr89G8tUrTTUWzEgvF/1DtNBUh4DRbpU7eSbI8n0JkFNVORes7hofp0tKQ+iGVv/gJZX3YQSs3KEkn2HkF09bFVs01Ig6Lv6+QrhZTgfUGGgk+ltGrz8ykM=; 20:/YBmWOlj8TZMasT+YjFLAitbvokwZcWe5gJsecif75QK2GUHRKKqGi7SJJoFQXPMIz+SsbemHnPdAC7B5T7ZshIU17u7QO92ekJUFXM9nSurCLlE04V3q3i/wDG0TEeSB4JYj5icOuCJP1h70LVX8J8OTzFc2rJm+42/05fwhUSQgeP864MCJYfJPK2HRKc3x8PRKNyGutU0cdg1na/7cNMIRxuZH0iNtFEULlQPTNskcM48fqpa/lwGZThrYm0VbiUD8IG+f1sUB1SUBcY3XQ4X3NqtdMhA4k12YTo8XJt/fK2i5XPHZkMWSKFeRjiwdYgQnIWiD8olwX15KRBd42CzimpPFwwwmsnzqCJ62AlR6Hqdz93MCbU6zVq2yJUqEm8cyPePhbURxFZrnGIk/s5kPjOlefbLpWMN5OumvVZBwMTQKbcvR64/I4X0ohoQbm2SJT8QN1oSUxI1rqW2aaFRII7WCJkoZd0aqCOga1S2rM9uTeYM8+30B+vqimWX2PEKtOluWS23OeTUVz5yU4dHJmkGYUrBjx/yzENih3AHWAwT0O4qnFS4SHNyS/dtdZYHk6HYeLbjSexwxM3OklbuNkOii1DYAulxJPa33fU=
X-Microsoft-Antispam-PRVS: <BYAPR01MB552725A196D2A5ADED0273E7A0810@BYAPR01MB5527.prod.exchangelabs.com>
X-Microsoft-Exchange-Diagnostics: 1; BYAPR01MB5527; 4:nmViYr8Twp7mNM+1PXYR9vNw4gF3Zez6tdyC8lUI+N6azTsNNuXi5W/tJXZNGGe98F7blbcm1Z/IJtOGsNt6L3r7pQOXfMrrvlvIOSAS/16ZyVxGov7nNGesK108oW8z8bVKX66ofC9s839JnFhJuilfqwW9jQqa1vFO5aputCWtaenpUImDryxx4KVBKSpYZNCuGHaa2YNZ8vgNriCT8A2FnWzIjVmhXFWsnUp6EunSJ+eRA/ucI/TXR0XncEjC/oRGQLchJS3UIaeIdp6en7+UN103tJwFoqIKKKI5Sgl5TkfFg6Ckew0tESqe5+ds
X-Forefront-PRVS: 0918748D70
X-Microsoft-Exchange-Diagnostics: 1; BYAPR01MB5527; 23:X5QzeR5GKuoBLX106/HPj5ovpnLfSy1FudwwE8pLdrVjvsLEAhL6P2FuKiMipOjEPJba5bSfjp1o7doXpGhN9bzrc+O4VvH5fcJs7NTxFEzVi+pVoeTBp3f8lTEWQrfZ8LPWgQOVkap0xi1YESgPnRAbxo75/UfzrPZfUq7sSvfBtFOJZTSZvUXBQCDonJlhBa1wcBO1uv7mglCVlITndesnDNGbC+qmjirnopCOJP0vNa6My89P61LWf/E1wWg8l9ZI4D8jjhjou/3FTj/Y4Zc6I8Uq9+DTLiHLlx9AqZflX2fQ50PIvEwUgoB/sthxwfQxSRP+B+V2W5YwtHIIg8BQIyQdGX0DVOoQaqe1GB2Lq1fHWCV2C8FFfEtiC+jwGmlYAat366ufRwciagtT+sT0nlvNKPcingx6QjHVcwAiCbaVWAlageXldcBOr7mFIU1JHfRk5CQrmncsBP326iS36ImMSy0O6xsCeeposzoh3cUlD8wpsNpexQgg0cEappSdyRCfDKmvyWtTACD9ygpIUKWnSxbL8TQGeFdt83XKehg4QwUWDIGElibPW0WdevB0nq+48G0oTFA0hvs9uumWo2VFkwv4MmN+OwNro5Qwma4zMwLt07a2Pu+2U640M08eutXh1mWX1C9vVihDp/kDRiiKluZ/l/j1kE/sEFwPsmkbRBfbXWfMTrqSUFEyPqIl5dIM4XTkSglEyytNkkujvmr/fKKSI4k8BrOGimCO9lkIWz0heEl+NOY0u/NnOiVdVEOqSVcuvLgsx1aa8I1XQlTqV02LY67G17idFsJ/3/bRIYteEbLwfxl8epFA9QAdoqKmSP3P56EQLHD+XO+pKzZAee1wDSc3snK7y2bQKokFBcvRNIWqUocV9k+n/bbEDSLhnon0EAuUZ83xTHytJjgS617EWfH9vyeOELZCWH/+essiCFJNBKNYO1AiJBYtjDFyYKGP1GJ1E2hUHjzP0yY024JIm8ZhkL8E6S/rZSAA9OzJar/a76ekmCX1vGC2UC2Jaxq15l7aZYTgBY4MsU8lh5QPYBQS2vHbFXoTFT1dpRZ2+b5fME1y/7zAerpXCh3ZfrHiL8e+45BUrMK2YcMp6B5ixzmyOVZs7TLaaCUqUUs6PiFNsKQWk5OhjK1SwjOgtHHP/NVF0anwNpr3yf//jOfPbVpcHwz7rRdkbxo/ESZuoGgpPLGQUj+xN4tSEOkp2qPLAZvxG+iPyvq43w95Vm99hgQzV4s8WzQ=
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Message-Info: CpDZ7zpQgjRSOEx86rWtDXBuswSpE9jp74dcZ4npIHjHWoANaHQaFvC0hD9NdffSMJ9cm3wpFE84Z9uAgmGmlmoSAa9lo26w7FNpzfdaOmWLUFuxqDLvfQBKP1qESOFMgk1rwX1OiFsGw/euenAPaiEdDp0nSUKOBkDAYvbrIcY1j0OX5A3UvaFjZ1mhDrcaw/t06KLvg2K7Q/4otfp+CJRgWeHk3VaNADakOzBiacmsltDyRwPOX0H+zGiUYNUabqqGLnqZPN80C7AadC9sSOMoNxry0TaPi6XY+r0fvfEYHAnEv/RGhKfNwcpvjn2fs9PT9tb7UAShCwtH2DUayYTD+OCdlsl4KR20SOAZKDGV3E8HyFaTClcDWYa5edvaObtAg+tN8jOWE0PAyKeyTzaUJ0f9ANrR1A6LG6TAw+s=
X-Microsoft-Exchange-Diagnostics: 1; BYAPR01MB5527; 6:9V4Gh3md81J9NZe2vkk4l8twWUG3jyGgBM3AJ394Dwg4XHS0YccB9+jYEwph3cwqbIvULd8mup0rGhnP+HyfMQnfSru9C7WnbYZ0maGnEtZq0Ol97kvduvisIorp7KwSaLXYkCC5gOFlNMWykZyPkl/IHH3Dud05u0dyObdHnFoyEsZVa27Zg03K/bteecS63imGqa9PSmjgzCfUj9t2rRJiwuR5RXfJh168fCw9uLYjB9KqJy7kdO9PqIxiS+lSoIvtlb7WC7H7mhK+vLihIzpobECtHx3wswOD6EO2/sVI71b9tYCgC6NOzT+msfa+kOfJFgnbXG1cl0+elRsIfm9w8B1q05AMMMH94XjH5tk0AsFluc6GipfSkIoAig9eqy4D3k50udI8ZuX25iCkB0khUwfvxAKf51ix9p/qP10Xz/7ebxob4wE7gyrSx+WVO+DuuGNvdRJ4F5GasnM7wA==; 5:WatHpvKNr92chGKssfW1klctboW53JpH+AvioTr03eebOrKhY8aFLnV7kcnGaJxGDOtjODpZx1NgsJ1CCqPACxAcCNdCzFmfYGGGDn0BBba8zEsK+nZgJbFELVFh7XWuqhgDFsWyzaIGl/VZVsbqrjQBfjfMoH5kjmZ23n9bJiwl1FHIICYj/1Dz+GO8fLSqmzDHDlD8aNXEbjTpLspapg==; 7:qMhpCCFdeALhiDl++vU0Csgj174S4dzldbkH2TloZY7BbOqy8tQq1uDFTBp7OFjgocyMcF4AyBe3iEIikKLQCDGbcc+XbxS41NYFLDmlv4k31eWIVrFK+bqdvOfC0NrVS7DQUQTm9GvFyBCRu3uv+g==
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jan 2019 04:09:48.8878 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 77ce6aa7-0754-44c3-2770-08d67a9f4acc
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=64afd9ba-0ecf-4acf-bc36-935f6235ba8b; Ip=[18.9.28.11]; Helo=[outgoing.mit.edu]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR01MB5527
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/l_aFNoQ0ombyXqwetixx8xp8CuM>
Subject: Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Jan 2019 04:09:54 -0000

On just one narrow point...

On Mon, Jan 14, 2019 at 02:28:59PM -0700, Brian Campbell wrote:
> 
> I will say that, in addition to the folks that have pointed out that
> renegotiation just isn't possible in some cases, my experience trying to do
> something like that in the past was not particularly successful or
> encouraging. That could have been my fault, of course, but still seems a
> relevant data point. I also have my doubts about the actual difficulty of

Also, the TLS folks get sad when we come up with new applications of
renegotiation -- its removal from TLS 1.3 made many people happy.

-Ben

> getting an AS to issue a 307 like response for requests based on the
> calling client and the likelihood that some/all OAuth client software would
> handle it appropriately.

v2.23.0 | Report a Bug | By Email