Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt

Brian Campbell <> Fri, 04 November 2016 21:18 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 822E012960B for <>; Fri, 4 Nov 2016 14:18:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.7
X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id oZ_g3ZLTV7Hk for <>; Fri, 4 Nov 2016 14:18:26 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4001:c0b::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 826811293DA for <>; Fri, 4 Nov 2016 14:18:25 -0700 (PDT)
Received: by with SMTP id u205so8994959itc.0 for <>; Fri, 04 Nov 2016 14:18:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=gmail; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=VvhQryLZ8JORx54ZGNqTlDEiWu+pZngltFVW3V5Pwx8=; b=ZPoxZGnoznMkKhxitxDDWAGaiuYphTci5bYbVyihrCRjOqRLMj6bY+1MhVcZEEnflG YRs5VARaF3621nCeC6Uq/0zhdsERIItwWlgzv99p0L2yKJGsEAi6ZgABwre2kiYby7q1 A20D++dLVnJZXPS5fZjVnpNUiAy4RghJ/yFiM=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=VvhQryLZ8JORx54ZGNqTlDEiWu+pZngltFVW3V5Pwx8=; b=VmVd1q/tgIyJ0Kl338WlBypz/Sqt6N6uMUTzeUTU4W6RZPyBD8lLX0UfnGP6IabcU6 +PS+6fpaq6Mw+MuKjprbvljDVs7RD3X2aGK0mrQ3w2zJd73yBNsZUtB5rUotDytS17d0 ZKp41se4AFrz8stWXoLbVY8mwEqx84LN4fym2K/Ku+w6FzSuBg5C8xgzNSHO2rW9K4TC 5Y4tbuz+8nqovpoJWA3qzikQ93M89v0Ti8e6U9Sdy5ILId53UbogvzSj89qcQo7Eje/i 3hwiNscJIvt1rwhu07z7xr4cZC83zO9TXsIMQyvWR6TKz3K42s0ZGuHxdgVWJ3+9zvXL 2UPw==
X-Gm-Message-State: ABUngvcQPc2ngRdWZmDnZxEGeg6U396WEhj9nzePZ0sLX/AehYpTyjUXWVqTdE4jDe4cKm2NATrWjyuAdPa7ogLo
X-Received: by with SMTP id p202mr5535067iod.47.1478294304758; Fri, 04 Nov 2016 14:18:24 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Fri, 4 Nov 2016 14:17:54 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <> <>
From: Brian Campbell <>
Date: Fri, 04 Nov 2016 15:17:54 -0600
Message-ID: <>
To: Justin Richer <>
Content-Type: multipart/alternative; boundary="94eb2c062c9ee8ba1f05408036a7"
Archived-At: <>
Cc: Nat Sakimura via Openid-specs-fapi <>, OAuth WG <>
Subject: Re: [OAUTH-WG] Fwd: New Version Notification for draft-campbell-oauth-tls-client-auth-00.txt
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 04 Nov 2016 21:18:28 -0000

few little things inline...

On Thu, Nov 3, 2016 at 6:41 AM, Justin Richer <> wrote:

> I agree that the client_id is unlikely to be found inside the certificate
> itself. The client_id is issued by the authorization server for the client
> to use at that single AS. The certificate is issued by the CA for the
> client to use on any connection. The AS and CA are not likely to be the
> same system in most deployments. The client will use the same cert across
> multiple connections, possibly multiple AS's, but the same isn't true of
> the client_id.

You said it better than I.

> Additionally, I think we want to allow for a binding of a self-signed
> certificate using dynamic registration, much the way that we already allow
> binding of a client-generated JWK today.
Binding the client to a self-signed certificate is pretty similar to
binding to the public key. But I agree it should be possible.

The jwks_uri or jwks client registration metadata parameters are well
suited to convey such info. The JWKs in them can convey the public key
(obviously) but can also can convey a self-signed certificate with the
"x5c" (X.509 Certificate Chain) parameter.

> I do think that more examples and guidance are warranted, though, to help
> AS developers.


>  -- Justin
> On 11/2/2016 5:03 PM, Brian Campbell wrote:
> On Sun, Oct 30, 2016 at 9:27 AM, Samuel Erdtman <> wrote:
>> I agree it is written so that the connection to the certificate is
>> implicitly required but I think it would be better if it was explicit
>> written since the lack of a connection would result in a potential security
>> hole.
> That's fair. I agree it can be made more explicit and that it be good to
> do so.
>> When it comes to the client_id I think subject common name or maybe
>> subject serial numbers will be the common location, and I think an example
>> would be valuable.
> In my experience and the way we built support for mutual TLS OAuth client
> auth the client_id value does not appear in the certificate anywhere. I'm
> not saying it can't happen but don't think it's particularly common.
> I can look at adding some examples, if there's some consensus that they'd
> be useful and this document moves forward.
>> I´m not saying it is a bad Idea just that I would prefer if it was not a
>> MUST.
>> With very limited addition of code it is just as easy to get the
>> certificate attribute for client id as it is to get it from the HTTP
>> request data (at least in java). I also think that with the requirement to
>> match the incoming certificate in some way one has to read out the
>> certificate that was used to establish the connection to do some kind of
>> matching.
> Getting data out of the certificate isn't a concern. I just believe that
> the constancy of having the client id parameter is worth the potential
> small amount duplicate data in some cases. It's just a -00 draft though and
> if the WG wants to proceed with this document, we seek further input and
> work towards some consensus.
> _______________________________________________
> OAuth mailing listOAuth@ietf.org