Re: [OAUTH-WG] Review of draft-ietf-oauth-jwt-bearer-09

Mike Jones <> Sat, 19 July 2014 16:00 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 809BF1B287E for <>; Sat, 19 Jul 2014 09:00:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dmDT7K3m8p2Y for <>; Sat, 19 Jul 2014 09:00:54 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 772591B2880 for <>; Sat, 19 Jul 2014 09:00:54 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.990.7; Sat, 19 Jul 2014 16:00:53 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.990.7; Sat, 19 Jul 2014 16:00:52 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.990.7 via Frontend Transport; Sat, 19 Jul 2014 16:00:51 +0000
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.980.11 via Frontend Transport; Sat, 19 Jul 2014 16:00:51 +0000
Received: from ([]) by ([]) with mapi id 14.03.0195.002; Sat, 19 Jul 2014 16:00:20 +0000
From: Mike Jones <>
To: Kathleen Moriarty <>, Brian Campbell <>
Thread-Topic: [OAUTH-WG] Review of draft-ietf-oauth-jwt-bearer-09
Thread-Index: AQHPlwV0CYCrEzmZtkW1H310hSfpcZum7GyAgAAfl4CAAGI3AIAAGZoAgAAFhgCAABmfQA==
Date: Sat, 19 Jul 2014 16:00:20 +0000
Message-ID: <>
References: <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: multipart/alternative; boundary="_000_4E1F6AAD24975D4BA5B16804296739439ADD6FB5TK5EX14MBXC294r_"
MIME-Version: 1.0
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:; CTRY:US; IPV:CAL; IPV:NLI; IPV:NLI; EFV:NLI; SFV:NSPM; SFS:(438002)(164054003)(55674003)(199002)(52604005)(24454002)(189002)(377454003)(77096002)(4396001)(95666004)(66066001)(19300405004)(50986999)(85852003)(83072002)(19617315012)(2656002)(31966008)(71186001)(20776003)(85306003)(76176999)(107046002)(99396002)(93886003)(80022001)(512874002)(84676001)(21056001)(74662001)(92566001)(76482001)(46102001)(44976005)(19625215002)(69596002)(97736001)(26826002)(92726001)(19580405001)(77982001)(83322001)(19580395003)(84326002)(104016003)(33656002)(68736004)(81156004)(106116001)(81542001)(79102001)(15975445006)(106466001)(64706001)(86612001)(54356999)(16236675004)(81342001)(87936001)(55846006)(74502001)(15202345003)(86362001)(6806004); DIR:OUT; SFP:; SCL:1; SRVR:BL2PR03MB242;; FPR:; MLV:ovrnspm; PTR:InfoDomainNonexistent; MX:1; LANG:en;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:
X-O365ENT-EOP-Header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY)
X-Forefront-PRVS: 02778BF158
Received-SPF: Pass (: domain of designates as permitted sender) receiver=; client-ip=;;
Authentication-Results: spf=pass (sender IP is;
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:
Cc: "" <>
Subject: Re: [OAUTH-WG] Review of draft-ietf-oauth-jwt-bearer-09
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 19 Jul 2014 16:00:59 -0000

I agree with Brian’s suggested text.  Thanks for writing this, Brian!

                                                            -- Mike

From: OAuth [] On Behalf Of Kathleen Moriarty
Sent: Saturday, July 19, 2014 7:28 AM
To: Brian Campbell
Subject: Re: [OAUTH-WG] Review of draft-ietf-oauth-jwt-bearer-09

Thanks, again!  I read the other message first and the one comment is the same to emphasize that you really should be encrypting to prevent disclosure.


Sent from my iPhone

On Jul 19, 2014, at 10:08 AM, Brian Campbell <<>> wrote:
I agree that mentioning the RS in this context is only likely to cause confusion.

This draft is only about sending a JWT to the token endpoint at an AS as an authorization grant or as client authentication.

On Sat, Jul 19, 2014 at 6:37 AM, John Bradley <<>> wrote:
While a JWT might generically have many different audiences like resource servers, this profile is about sending it to the token endpoint at an AS for authentication or authorization.

I think adding something about the RS will confuse people.

I think Brian's text is fine.

John B.

On Jul 18, 2014, at 11:45 PM, Phil Hunt <<>> wrote:

Should that be encrypted for the intended audience (aud) of the JWT which may be the AS and/or the resource server?


On Jul 18, 2014, at 21:52, Brian Campbell <<>> wrote:
Sorry for the slow response on this Kathleen, my day job has been keeping me busy recently. And, honestly, I was kind of hopeful someone would volunteer some text in the meantime. But that didn't happen so how about the following?

A JWT may contain privacy-sensitive information and, to prevent disclosure of such information to unintended parties, should only be transmitted over encrypted channels, such as TLS. In cases where it’s desirable to prevent disclosure of certain information the client, the JWT may be be encrypted to the authorization server.

Deployments should determine the minimum amount of information necessary to complete the exchange and include only such claims in the JWT. In some cases the "sub" (subject) claim can be a value representing an anonymous or pseudonymous user as described in Section 6.3.1 of the Assertion Framework for OAuth 2.0 Client Authentication and Authorization Grants [].

On Thu, Jul 3, 2014 at 3:26 PM, Kathleen Moriarty <<>> wrote:


I just read through draft-ietf-oauth-jwt-bearer-09 and it looks good.  The only question/comment I have is that I don't see any mention of privacy considerations in the referenced security sections.  COuld you add something?  It is easily addressed by section 10.8 of RFC6749, but there is no mention of privacy considerations.  I'm sure folks could generate great stories about who accessing what causing privacy considerations to be important.

Thanks & have a nice weekend!


Best regards,

OAuth mailing list<>

OAuth mailing list<>
OAuth mailing list<>

OAuth mailing list<>