IETF Logo Mail Archive

Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint

Benjamin Kaduk <kaduk@mit.edu> Tue, 08 January 2019 23:56 UTC

Return-Path: <kaduk@mit.edu>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED54512E036 for <oauth@ietfa.amsl.com>; Tue, 8 Jan 2019 15:56:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mit.edu
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E1981jH5J6rU for <oauth@ietfa.amsl.com>; Tue, 8 Jan 2019 15:56:29 -0800 (PST)
Received: from NAM05-DM3-obe.outbound.protection.outlook.com (mail-dm3nam05on0706.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe51::706]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 471FD12D4ED for <oauth@ietf.org>; Tue, 8 Jan 2019 15:56:29 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bGbJz3a9J2ZVd1fRZ85bSWFbeEwDBtc9R9Wp/GiL9ew=; b=R5gIZRuVNT3WHDeLC63yIRsvSLUCnq5wIuyz7LsNmP6aMW9+9qbR/m6L8Ku3ulSDnjDdpKGm8xhO+zFsuJuU/rAfbUe1vb7w/37s29auj7qN75GKDMCaWCGaNdBDyXETrG4UIMSeE6gZW8qOvziwvL2mkCucd9XvegnWf5VQcmE=
Received: from DM5PR0101CA0020.prod.exchangelabs.com (2603:10b6:4:28::33) by BN8PR01MB5522.prod.exchangelabs.com (2603:10b6:408:ba::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1495.6; Tue, 8 Jan 2019 23:56:27 +0000
Received: from DM3NAM03FT039.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::201) by DM5PR0101CA0020.outlook.office365.com (2603:10b6:4:28::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1516.13 via Frontend Transport; Tue, 8 Jan 2019 23:56:27 +0000
Authentication-Results: spf=pass (sender IP is 18.9.28.11) smtp.mailfrom=mit.edu; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates 18.9.28.11 as permitted sender) receiver=protection.outlook.com; client-ip=18.9.28.11; helo=outgoing.mit.edu;
Received: from outgoing.mit.edu (18.9.28.11) by DM3NAM03FT039.mail.protection.outlook.com (10.152.83.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1471.13 via Frontend Transport; Tue, 8 Jan 2019 23:56:27 +0000
Received: from kduck.kaduk.org (24-107-191-124.dhcp.stls.mo.charter.com [24.107.191.124]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x08NuOPN021185 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 8 Jan 2019 18:56:26 -0500
Date: Tue, 08 Jan 2019 17:56:23 -0600
From: Benjamin Kaduk <kaduk@mit.edu>
To: Brian Campbell <bcampbell@pingidentity.com>
CC: Neil Madden <neil.madden@forgerock.com>, oauth <oauth@ietf.org>
Message-ID: <20190108235623.GC28515@kduck.kaduk.org>
References: <CA+k3eCTKSFiiTw8--qBS0R2YVQ0MY0eKrMBvBNE4pauSr1rHcA@mail.gmail.com> <6A614742-290D-47E2-B3E9-A4D49DB32DD7@forgerock.com> <CA+k3eCSoNRGrsxeLYd6DEqU+U6TB_aXV2aPUa07Um2X0ZH_ZEw@mail.gmail.com> <20190104215540.GL86936@kduck.kaduk.org> <CA+k3eCR9JVmeUcuGaDgDvcFz4L=uXph+CZ_=cJVSc4NJP2DG+Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CA+k3eCR9JVmeUcuGaDgDvcFz4L=uXph+CZ_=cJVSc4NJP2DG+Q@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report: CIP:18.9.28.11; IPV:CAL; SCL:-1; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(376002)(346002)(39860400002)(136003)(396003)(2980300002)(199004)(189003)(106002)(88552002)(426003)(54906003)(6246003)(8936002)(55016002)(2906002)(246002)(446003)(9686003)(36906005)(478600001)(229853002)(58126008)(786003)(1076003)(93886005)(46406003)(16586007)(316002)(956004)(53416004)(26826003)(11346002)(106466001)(476003)(75432002)(33656002)(336012)(6916009)(561944003)(8676002)(23726003)(104016004)(76176011)(7696005)(126002)(50466002)(26005)(356004)(6666004)(86362001)(5660300001)(97756001)(186003)(305945005)(486006)(47776003)(4326008)(18370500001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN8PR01MB5522; H:outgoing.mit.edu; FPR:; SPF:Pass; LANG:en; PTR:outgoing-auth-1.mit.edu; A:1; MX:1;
X-Microsoft-Exchange-Diagnostics: 1; DM3NAM03FT039; 1:u58OMJ1F1J8EmRfKtTiTH4uxFJN29HXH4PIawv+oCms+v/wQ/s+L1VkY70Wcr1dMilSAxO9D3nrPi+YrcUJijWxcyQOhYNUPs09i/Q1s0yO0x900PqEXxDZRed9C0poU
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 41c3f7ce-39c1-4fb0-f12b-08d675c4e76c
X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600109)(711020)(4608076)(4709027)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060); SRVR:BN8PR01MB5522;
X-Microsoft-Exchange-Diagnostics: 1; BN8PR01MB5522; 3:/eq510MdnZddcr1n979PM9R/gl+rNU/7DjIaehO7kb6vfqdRTJ03R69iO22T4vJmvsUP7cTLLhFteX5Q4KgQHuatPwZCEX/p5K4zsJRuZ4sISfOG4GsNTfAhR3nIjvjq3Y2cKUGEgeE5u0MoAhltZavZPLEnLN+jSMXuzX53NAcsNR27reLjwyj/BxckvsQA9mPfH0cEDYY7NaQ6+UkxnU2Tvq7Vn10IIMUGxBc7/tK8/lAG7W9u+GAW5lONM/8/I2/oqwKEQipkfEjaLfp11TzaY5orMVpbodsY3TLQy8yXTQypF4fjRo0Acq7FuXkBADKgvXr1nl1vLg5UzEKY057X7pfZO+GlSg8Nm1Xp4JHGNlyK6fmBo9y/BXLPzHJP; 25:NpGzLDj0UREuevfHtshSaMMNeNx5/Zbm8FQsXpFiHPKJO3HvzUnh1HRSKUnE+U2f9U0RLTKwVumcTwuUn+ymVhWqpYdnJ03PbNgNt4tFI89+1m3Iw/mhbAmLAkWTcx3iyDffjo3WyJgwZC/YxpKkV4PumdEt4WL45odIFOCFrcyugAz0iZtfOi1coZEReGAyPXbbGpxf9Tfu7kJzwJwxMCJoVcR/YmuUe1otc9qbZ7hVq5RCRKQl+l3dET3Ffy0b0ocfRBjktvgxSm/YXWTv5CZM2Jh6GmHIxutVoA4stN3zlY6A9KUcBQT5WEu7ikx0vhPjxlHfXyUjF1NF8yAIsQ==
X-MS-TrafficTypeDiagnostic: BN8PR01MB5522:
X-Microsoft-Exchange-Diagnostics: 1; BN8PR01MB5522; 31:IY6C8lEAPJ+Wx95jbb0IEmGG7qkrubD/lhdMQOWCL0pWvW+weZJ43lr9ydebO/9cicAn9GWGnqO0vHdojOaH3MEaZzbCJRApYnY4ZIzQV2Vzv6W9ATwp6iFcMSJcTJpX91DDWJbZuxaWHRZb1sxQ0pD0khjWjfGr4MXavBOk9OnTwuMeGlzSH0Va2G6qPvu1dvwQ8nhACQjmF2+QCwxA2WwTUduuT/CZCu9rwKNM2no=; 20:p2nKVJIpmmmzgULvGxSXmq+xYamjc47xU5e3aSySWxpsvjRDL2KNZkAfPARbsFyyRdjgnFZ7MbaXnl9WndFVyKRx2KRfCs+ovW2zfLoCLiGnxNJdnCUNDIVcaBbFmGeRfSicnqWzN7VX5S70gX/VF3p88MRCK2vdZsWcFHKy+hcw27yfRB1bO6J+QAd2iAhyi9tI3z7BBOeDO14/aLHXXL/gT93yOKEdK9qrtHTJRAJ9Qps4Wwqnj9jR9xmGhKXXOp/PZnasa/++wi5NAgYcfLTf7rWlFSYyA0AmBAf1Z2rOP5h2spo01s4bh3n/vywPx9O9K21wDwtl/ybmjX5c3ON/dq8ksbnGd7o72/kfc9KNXSBI0dReeddSFNOnuz5Bnwg8CeB0yxcdEtZ12rtqbcDmdEqNYIdkWHyfdRBAcI/Parwo2itk5MR/JqLrcaeW7OP31U9N3kN+8VYnu68jeTBPaPi5EBf7ubnN5YKCwCEk9BL64+TfN93ZND+W35k1
X-Microsoft-Antispam-PRVS: <BN8PR01MB55229C04CC1C647061005B82A08A0@BN8PR01MB5522.prod.exchangelabs.com>
X-Microsoft-Exchange-Diagnostics: 1; BN8PR01MB5522; 4:K+SLcALOJzN9JBt/Lbfh07Cwa6VIYdyC0zbfmxTmy8oydx1fZEHkGJ2XbupchytoyTg9NXzUD5JZ1A6Xx9YUhzKwL/XprLjM1ZwUKysG+jghBTQEn529P7dPiS6ui0UglEw3Clv9m6w8C4bTvSs81le+dlOq9MgIc3AhxXUfvGJqzUzizklLsE/ImTRkBoF+Z59xdigvW+7m/RL+D+u7uQF/g7V6chfIZC2CDbK0tGZejoX7jYT1lXbvELxgFoO4pzyl+WVvNrblRYy9VVW9UynRch20WplGibYW6/7/S058uvY6rWQMB4E2IdbRWab1
X-Forefront-PRVS: 0911D5CE78
X-Microsoft-Exchange-Diagnostics: 1; BN8PR01MB5522; 23:3d5pSFb+nyvM5cHOuGehzmD6v78eg+ktkyIG2kS0DwTS6eMcU5rzWW2tjWpfKgatcn4XJRhb3paqA3EueciQXTQpOzZtsayddvTakFfLGivzi2IUANt2f1xp8zUunAZa9TN4yhtT7qCXATtCdm8WBLQPRjm131FHE4070I/H9DjWy8A7f6NKJJFDKSaWFd7bvU/65DGWLhjtxLZcV0FwtF485YujctPMQffQAGPnFXvh17DuhKvZ6ojLbdWOiX77Jczn6wpBIlEpZyyrh/2szoNQxMavwVYm221C1mItKLq5eiDyd6y/QlqroZIm9tjzOsBHAVUfDS3brlPZc6axj5Vv7amK9b+QRUsF+tZ0jvD4lBtRuHoAPl6vNrvNCB/6B3V3xDOoJ0DkE5Uxe0/EmQLqSs+Zi+Pv5dqSfCiMb7flyQQLR5n3s1f2ppXGcgCVz5RZkRvFQPb+Ne2aRU7s7uLHC5FdJnBd1ITcyZFan9RdIoJe3HeJqeTr7NFbDyDXWn2fJ+ys8r0nQMarlo7Q4i+WVJzz7C3CeEYSekxUcZNjSVwAYh8JDf1qkAk0bTKK9diGRu+w10JUdKwT5KDaK54H44XxV0TcVXSH5XZREfx6N0W+Eb5Ml9OfiJscdsUHeA99WasZkUmLOdtE01hpEc0nvIaSfsHlkDFR90iPxBmPEGM7Lgy5+7HmZMKxvuuF/ryEWEBelxeWSiv8p9ANKKFXLvOYZlat+WS95tcnt9kN0unxq7r23rtspXt+e9XxklJLh2uT6JBagLA7Y/hBRi7/j4cbyunlHpbAxOKeWeUhSa/K+MFgBGSERex5a7NlXCpn6Udfbx52QDb4Y83Hg0sLVPIeKFmdOD2rk0FEzTP8j+LSz15YCa+ALequtPTjFIWzX5lDGhPnyspTOI0HfZOE7wWv0JWnFKRYhEdpAAo0bET0q1Uxv3yONlqbi1P9eRAS4RgpojtqT1lQezyGPWr0rvnd81EdswVUG1lhfm1zcKyitzMLW9LrKB4zr5IQhRtVFZaBT/yAWvLxc0Dgq2Wvc8Udzcq23EHAN7NuWcQuYj12QzXBRwN6NSXuiJ+3YTFV7HogT0nVOYSh9Syf68h4LNcKo6Yx0GsnFD0u4cG7uVR1rH4QT9CB4QR+8dDetDy/vDITxwWhFbSluuFpkmq0tmbvo4M3W0Y3fpsvT6DIa4/XK9SkEL7vnkyxRvLcuHr3D35mmNassgz9cPaGRZi/0eKr4GAmF4VDIzPY4Qw3oZxP4IF5Yu9+7zXY8gkDWcSix/Mc77e9oUNJR50gZQ==
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Message-Info: yj8Au+5laS0S9Qq00krEdarr457kQ4aYMupncj2MGdsjxt+nOIqJseizE2/vvUYzP89aC5iouYv3TcB44j8PluZQUvORO5HPVqWEwQWc3jt7MyhmoEPfrFSnSzqPWH7O3u8sgO4vr+oKajPt4fU/O8JmSoxGbGye54XrWktU+Nzz+gTYjWBxQVvmAXyushOhJxp6bbjrLgaqQhK0uyV2DZ7OQp17une0XcPqpkG2jpN8Gq/HOxcjBr07gsC3r6ySUT9HcMWB220mixpk6VnktfB5VUeZFyc4zpks6uu74t40mkh2rUX3v5IPGH09nzwd
X-Microsoft-Exchange-Diagnostics: 1; BN8PR01MB5522; 6:f/NdopUYd4T13Fa38VW2ryOtNQhY3vcx17PeyCv9XOkzY7dsB9AByjjYl+u7crlvRv6qRPbU9R57HAj08Pi9S3lfgEy8ATYHKNQ7lErRNoubpcPam4JOas34lowtA+sMx6UUs/fS36MQyUrgnhD5pNXxNoJBZDh0E2Kr5Li0pzn6DoMBEvesmz8YuJVEoXn5Nm4ah51QyDJy6lW5iz6etgEkRf1s1wZUzPAtziRn524nhU7SlNZTKbGpYBRrF/40eB/WOMnta3uwE8FB5d9yczecxQL/QH6lIGTyd1+Z8YOQR1MT2eUnc5px8tkY+tEvfncTdKF5upNs1RznHAdJ0W9rrhpgw1UFw5vyffIUhWl9VYJ/KkTrLG4Ku1Cb4okH/qssHlJDwJFW5hcLDFjdKf6sFNqSspV+IpmEg2UEjhgWEMEl+mYI8qhvmBeRaCWH554mPP2EoDLjoNoXny01pQ==; 5:syc9+KHQYXx9Q9G0Y2phCz9u8rSrs3UVrt1jam0JS/fs4qf25EGd6dY8cokln/ZbUoWiA3t46eNNXq+fVSNZDlFSkzY05Puj1NTR3w4rZW63VjNIyuXivgqb7hjThumfSJd7pCOuu7MDo62Yz///jELTDoilj7Isf2qgPzd6tRXorBWgNZGP+rh0XZZHX/4DJ25JogQdp4jKBTefZzLJ3Q==; 7:V5x/wuUr4GqM5A6PWJLPwPdQaabubV0Kn018V1sF2YmjD25uDStYnNdbZ8me3lyVWRRYcH/BuCJihWbAzeKNH0xFrd1/Igtabwu67unZfZdjFHdZbCnQ+5rdH4kx1p7GAM6X1mW4nZ8QMQeaqKWniQ==
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: mit.edu
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jan 2019 23:56:27.2938 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 41c3f7ce-39c1-4fb0-f12b-08d675c4e76c
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=64afd9ba-0ecf-4acf-bc36-935f6235ba8b; Ip=[18.9.28.11]; Helo=[outgoing.mit.edu]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR01MB5522
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/rmCR_kDuP7mbvnwVRznyemH7n7k>
Subject: Re: [OAUTH-WG] MTLS and in-browser clients using the token endpoint
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Jan 2019 23:56:32 -0000

On Mon, Jan 07, 2019 at 10:21:51AM -0700, Brian Campbell wrote:
> I don't honestly know for sure but I suspect that employees of big
> corporations will likely have keys/certs on their devices/machines that are
> issued by some internal CA and provisioned to them automatically (and in
> many cases without the user knowing and/or understanding that they are
> there and why). Those users would likely be prompted when TLS handshaking
> with a server that presents an empty list of CAs in the
> certificate_authorities of the CertificateRequest.
> 
> I dunno. Maybe I was too quick to retract the proposal for the MTLS
> supporting secondary token endpoint?
> 
> What do folks (including Ben & Neil) think?

Sorry for the slow reply.  I agree with Filip that we can't be confident
that the affected population is a vanishingly small population, so it
probably does make sense to continue thinking about how we can present a
better UX.

-Ben

v2.23.0 | Report a Bug | By Email