Re: [OAUTH-WG] client certs and TLS Terminating Reverse Proxies (was Re: I-D Action: draft-ietf-oauth-jwt-introspection-response-08.txt)

Hans Zandbelt <hans.zandbelt@zmartzone.eu> Thu, 31 October 2019 10:49 UTC

Return-Path: <hans.zandbelt@zmartzone.eu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65BB11200F6 for <oauth@ietfa.amsl.com>; Thu, 31 Oct 2019 03:49:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=zmartzone-eu.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7kRrixzQu7-2 for <oauth@ietfa.amsl.com>; Thu, 31 Oct 2019 03:48:58 -0700 (PDT)
Received: from mail-qk1-x732.google.com (mail-qk1-x732.google.com [IPv6:2607:f8b0:4864:20::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4049B1200E6 for <oauth@ietf.org>; Thu, 31 Oct 2019 03:48:58 -0700 (PDT)
Received: by mail-qk1-x732.google.com with SMTP id 15so6477177qkh.6 for <oauth@ietf.org>; Thu, 31 Oct 2019 03:48:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zmartzone-eu.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=XYmUv4W5+wbHMnMvQMYskBzah5zwKRUeh0W8IhcExIQ=; b=IccRVxhmiB/l80fX8IVXzjhau1g8uS9F5FuLd//efQuH08C3pQCpIVO+b1/IKgkL6Z ZKfU4PEG1hhIxlDHDheGoemAHb7IjIqRv2djINdNxtfeV0yPIcxDMFucH589Te72nMWw 93LAZDZhqc0D/Fm/Ax+xEZ5hKBr/z2QqcNu3lnFHOFMbYvT4m+yxqdSgNcJRmk2SCBY4 Te3bYSSt5yWfVjNQuhPhrQ7ScWfJD6mELzQFkNlVsZ+a/z7Gt0xM0ydMBTL5QqlpFWPW 0d1En2TN4EInD8QF1aSsMt4gGI+jidpHnU35UVjbkJnpisnoNeOrnl+fyc7GlhPJ0Vo8 nf/Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=XYmUv4W5+wbHMnMvQMYskBzah5zwKRUeh0W8IhcExIQ=; b=Lb//FjHe3aDGcEvy33f6XeKi+LajJj8DOTaIurMrl8nIfsWeD/6ci4ac+neqSfhiUJ ASoLGgsAkVGuZF5deymMBppPassxui6QdH+BV8vsbOuNMf1iNtVU4DYqLLyKuCOYlmtx ixddW0xXCJ8PRzGg30I3YGjcOGmFG8ohucuChhsKa+U1yB4ngc4nuTDdAWCa+y+Z/srY Px3r8Avsq/vxbYq8Hp+k9tMQbleGn44svknUyIK1Adb176SAntnGj4eMWyhmD9yO63Bu svLJYPVQktSaQyuDGHv7HcQ5wX8aU1T59vFJaihd6LGvx2SP0WfzGyniCsybaDH6bair yg1g==
X-Gm-Message-State: APjAAAWmRSh5IZTYe6YP6irEEBpqjXa/O8mlaZ2OwQ5wenOzimUXC++q U2yXzzwjZykkson7dotYtbfPyQBO4/Bsm9mabV5UYQ==
X-Google-Smtp-Source: APXvYqzNk3miHwpMYpaNzzvAOMzdhKbyXdiAW1HcY1UqotEpT5qN5rL0pqYxcuHhpoirwrPm8ShM5MkQrldgAmrEIjE=
X-Received: by 2002:a37:e40d:: with SMTP id y13mr4575871qkf.478.1572518937129; Thu, 31 Oct 2019 03:48:57 -0700 (PDT)
MIME-Version: 1.0
References: <85D42AA1-FF57-4383-BACB-57C5AA32CFAC@lodderstedt.net> <CAEKOcs2gkM3Henz5nS04_EuBQXWWbJU5K02ErP0rnVZXmjxXJQ@mail.gmail.com> <20191021020546.GZ43312@kduck.mit.edu> <CA+k3eCS7pf3wXBkpbXE0AXKUGogo0YcHd8oWfiBfkPB5axGQQw@mail.gmail.com> <8A8B8892-9D16-4210-BC13-47B5D7859976@mit.edu> <20191024170326.GO69013@kduck.mit.edu> <CAGL6epJZtTXKSGFj0BfhF3kd_Z-z2xzOWXOPEKXc5m18Z4L1uA@mail.gmail.com> <CA+k3eCS8VuCfy4XeqYmLuuLK=rLvHsonSZj4i9O11U-mcua9Pg@mail.gmail.com> <CAGL6epKTV5hXqm2-qgUyG-iA90eLu49GjOKeyLcfsn2naTSV5w@mail.gmail.com> <CA+k3eCQ87n4m--nBc+PX7qE727fqA6vM=meEJZxwfnbpJ2dOsw@mail.gmail.com> <CAGL6epJQbVDrAKB+zNAPuaG0+uLxF3HijEE6=vgYaeXxB_2PXQ@mail.gmail.com> <CA+k3eCQbku0V6z2wCM084FW342dY6=_H7mEv6U3sHCDgefkxXA@mail.gmail.com> <E03CD445-39E8-4262-97BE-E0EE11231A63@forgerock.com> <2B2ACEE8-7B48-4E2D-94DA-AF3DA86DE809@mit.edu> <CA+k3eCRmmZJQjk-WGmpYZeyTvQR0SttRUZeh7FDT-=ikzOUwAA@mail.gmail.com> <d2dd4b24-a7d5-5080-4ddc-05e9a742d5d3@connect2id.com>
In-Reply-To: <d2dd4b24-a7d5-5080-4ddc-05e9a742d5d3@connect2id.com>
From: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Date: Thu, 31 Oct 2019 11:48:46 +0100
Message-ID: <CA+iA6uiCu8KZM8xpxqxuF4cGR-n53c=w03-h9Ja1rpVsg0goQg@mail.gmail.com>
To: Vladimir Dzhuvinov <vladimir@connect2id.com>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000a68da40596329806"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/rSoZmDjWliP5PslTuFO_RUAXjIs>
Subject: Re: [OAUTH-WG] client certs and TLS Terminating Reverse Proxies (was Re: I-D Action: draft-ietf-oauth-jwt-introspection-response-08.txt)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 31 Oct 2019 10:49:01 -0000

the way I see this is that stripping and setting the headers must be part
of the implementation of the protocol itself, it should not be something
left to a non-atomic piece of configuration by an administrator; I
implemented it like this in the Apache implementation of Brian's TTRP spec
[1] and have been doing this for the OIDC and OAuth Apache modules that set
headers for backends to consume [2]; and yes, I have made mistakes [3], but
IMHO it should not be a problem to use a well known header and make the
implementer (not the admin) get it right by pointing this out in the spec,
as is done for many other pitfalls

Hans.

[1]
https://github.com/zmartzone/mod_token_binding/blob/master/src/mod_token_binding.c#L481-L483
[2]
https://github.com/zmartzone/mod_auth_openidc/blob/master/src/mod_auth_openidc.c#L164-L175
[3] https://www.cvedetails.com/cve/CVE-2017-6413/

On Thu, Oct 31, 2019 at 11:37 AM Vladimir Dzhuvinov <vladimir@connect2id.com>;
wrote:

> All in all, I am in favor of this being defined in one standard way, in
> addition to secure communication between proxies and backends being
> standardized — but this latter bit really seems like a separate problem.
>
>  — Justin
>
> -1 for devising a well known header
>
> +1 for a simple way to authenticate a reverse proxy with a web server
>
> With a well known name, in a attack this will get probed first. The well
> known header name doesn't guarantee a correct config. And if we have a new
> standard for sec headers that must be stripped automatically from inbound
> HTTP requests, we cannot expect that will get implemented in all reverse
> proxy software overnight.
>
> Because a correct config is not practical as the only line of defense,
> when we implemented mTLS we decided to add a length (>= 32 chars) and
> randomness check to the header config. I saw some concerns that this may
> cause deployment issues. Nobody has complained about that so far.
>
>
> https://connect2id.com/products/server/docs/config/core#op-tls-clientX509CertHeader
>
> Regarding mistyping, this can be an issue, but has little to no effect if
> a long random header gets misstyped (from the inbound strip directive).
> With a well known header this will result in a immediate security hole,
> which can theoretically go unnoticed.
>
> Here is an example Apache httpd config, to illustrate my point:
>
> RequestHeader set Sec-Client-X509-Cert-liede5vaePeeMiYie0xu2jaudauleing ""
> RequestHeader set Sec-Client-X509-Cert-liede5vaePeeMiYie0xu2jaudauleing "%{SSL_CLIENT_CERT}s"
>
> (the first line strips the inbound headers)
>
>
> Vladimir
>
> --
> Vladimir Dzhuvinov
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>


-- 
hans.zandbelt@zmartzone.eu
ZmartZone IAM - www.zmartzone.eu