Re: [OAUTH-WG] RFC 8705 (oauth-mtls): RS error code for missing client certificate

Just to make sure I understand the process, is it going to be something
like draft-XXXXXX-oauth-mtls-rfc8705-bis ->
draft-ietf-oauth-mtls-rfc8705-bis -> new RFC that will obsolete the current
one? CCing my colleague Takashi Norimatsu who worked on MTLS holder-of-key
for Keycloak, perhaps he has more ideas for improvements.

As for this stance:

> The MTLS draft also re-uses “Bearer” as a token header, which is also a
> mistake in my opinion.
>

Did you mean the re-use of the "Bearer" scheme for the Authorization header
and WWW-Authenticate challenge? If so, and if we decide to introduce a new
scheme, I think this would imply a new value for the "token_type" token
response attribute as well.

Of particular interest to me is the question whether different binding
mechanisms (DPoP, MTLS) could co-exist, or should they be mutually
exclusive; this deserves a separate thread though.

- Dmitry

On Thu, Nov 11, 2021 at 10:22 AM Justin Richer <jricher@mit.edu> wrote:

> Only if this working group wanted to take up the work of making a new
> revision of the standard, but I haven't seen any indication of desire to do
> that here. One possibility is for you to propose an update as an individual
> draft to the group here.
>
> -Justin
> ________________________________________
> From: Dmitry Telegin [dmitryt@backbase.com]
> Sent: Wednesday, November 10, 2021 1:34 PM
> To: Justin Richer
> Cc: oauth
> Subject: Re: [OAUTH-WG] RFC 8705 (oauth-mtls): RS error code for missing
> client certificate
>
> Thanks for the reply. That makes sense.
>
> Given that MTLS is not a draft but rather a proposed standard (RFC 8705),
> do you think there is a chance the changes you proposed could land in MTLS
> one day?
>
> On Wed, Nov 10, 2021 at 6:24 PM Justin Richer <jricher@mit.edu<mailto:
> jricher@mit.edu>> wrote:
> This is just my interpretation, but this feels more like invalid token,
> because you’re not presenting all of the material required for the token
> itself. The DPoP draft has added “invalid_dpop_proof” as an error code,
> which I think is even better, but the MTLS draft is missing such an element
> and that is arguably a mistake in the document. The MTLS draft also re-uses
> “Bearer” as a token header, which is also a mistake in my opinion.
>
> But given the codes available, “invalid_token” seems to fit better because
> you aren’t messing up the request _to the resource_ itself, you’re messing
> up the token presentation.
>
>  — Justin
>
> On Nov 10, 2021, at 10:17 AM, Dmitry Telegin <dmitryt=
> 40backbase.com@dmarc.ietf.org<mailto:dmitryt=40backbase.com@dmarc.ietf.org>>
> wrote:
>
> Any updates on this one? The missing certificate case looks more like
> "invalid_request" to me:
>
>
> invalid_request
>          The request is missing a required parameter, includes an
>          unsupported parameter or parameter value, repeats the same
>          parameter, uses more than one method for including an access
>          token, or is otherwise malformed.  The resource server SHOULD
>          respond with the HTTP 400 (Bad Request) status code.
>
>
> On Fri, Sep 24, 2021 at 2:23 AM Dmitry Telegin <dmitryt@backbase.com
> <mailto:dmitryt@backbase.com>> wrote:
> From the document:
>
>
>    The protected resource MUST obtain, from its TLS implementation
>    layer, the client certificate used for mutual TLS and MUST verify
>    that the certificate matches the certificate associated with the
>    access token.  If they do not match, the resource access attempt MUST
>    be rejected with an error, per [RFC6750<
> https://datatracker.ietf.org/doc/html/rfc6750>], using an HTTP 401 status
>    code and the "invalid_token" error code.
>
> Should the same error code be used in the case when the resource failed to
> obtain a certificate from the TLS layer? This could happen, for example, if
> the TLS stack has been misconfigured (e.g. verify-client="REQUESTED"
> instead of "REQUIRED" for Undertow), and the user agent provided no
> certificate.
>
> Thanks,
> Dmitry
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org<mailto:OAuth@ietf.org>
> https://www.ietf.org/mailman/listinfo/oauth
>
>