IETF Logo Mail Archive

Re: [OAUTH-WG] Refresh tokens

Tomek Stojecki <tstojecki@yahoo.com> Mon, 22 July 2019 11:03 UTC

Return-Path: <tstojecki@yahoo.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4991612015A for <oauth@ietfa.amsl.com>; Mon, 22 Jul 2019 04:03:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=yahoo.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 67sV0lOMMoe4 for <oauth@ietfa.amsl.com>; Mon, 22 Jul 2019 04:03:40 -0700 (PDT)
Received: from sonic311-23.consmr.mail.ne1.yahoo.com (sonic311-23.consmr.mail.ne1.yahoo.com [66.163.188.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A702120255 for <oauth@ietf.org>; Mon, 22 Jul 2019 04:03:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1563793419; bh=hYFzv2jgwAhyh5eXUt2sC2Q4s3lMVksfr3Z6WAT6HMk=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From:Subject; b=U3UjKLhsXQfrCSm6m3nNuJoPXkfVvvgz9Qj1RSElblOQDMTyyCR0xyKAeYzPZu8WXCU4rWBrwIZGQi3NjdU1+Hc7uerhtky9tcuKAwAxyXcTROYGYvyOmbLCyRM0ZeA0MMMIkP6CF/em9Qgs9Hutt1LjvXfthji4vO+aoKThgw+m+cS1jqDbxQdh+S8k/aYorNBl4FMt1v5w4f7dnwSdUxiOF2RhE+biHCOB/5TOQHi4LyHCPAkje220FGtYMQUrdIrnci2gheJ4xCdNOZ5j3FUT7HBnJgXUmpkl9zDpzX0lOdlwuiZsQS/vCYtOuCo4DT8eCOg6ZNjPFRTsbQo8dQ==
X-YMail-OSG: 0oyZwowVM1kZyHIlJW4oru5jyxgPwIlifLoezW1nORwuOV6zaeJBIIXy33pt0g3 J3v6CKEQPOUHqPXLGMvd35tinXaBTGTI89EvH5CpR2z9GPjOqg.imDm.VJcBihZ2hF3_YL22xAuw iNAHrUpSMGaAUvczuK_g.c8DqEhYUE5VkzfngoeXHvXsNgE4DKVj1VoOvkXwsuGsllaldRXgV347 v5SYCaHFtv1z2.aWztveen_ssLmUzXMgoAg5E7ItPMFirgY7tb1PjJZXmLtBLTjK5ic4uJAWMVnK fbDEKXbhb6GoUFbCn8IWSx02mJPPGEjk1E786LQvZqEx5TWFggeZo4c8VMyQN.jO.77XrI4A8erp LBUwLcHLkamniKcTIlPVZtyoGwaDl5w1E1ZrWMLw1X.jh6ph4hqEO.tXU_tl2Xv.TzuC5SHzPAIL AR5pDoE2_zIE30hkoP9BwOBrheEdKe1HiN0nnwBieo4lil_hVBx2Z3xshhQysZp4aZmHPrZKFgMu VgNFN5m4.1esknpZshUK7ZnSBmKB3lOsjJVfjqY.ghskFCVURZM0h9mUCGA8mrbFLRvnD_pZxKvO Q725EhxOTKxecE0ktDFaQJoYtQ38fUSEqT36m.I5Br5KSZWRIQCVlfpLc1AjCNBbNPSNqcne._6h BVeCwi3VAaqPnN2cG1yJCQBawqWMtXnTZpx_BKWtToKcbFVcw_JS_NLV1Yugd6PtdOuKJa5e1kbK BWDpfVgfHAIcRbBclrT_wL9GEdhfpq62.7r2yjmKHAQmFjwI1797vBUsKaOGcz5mB0PoTTgwYMGl jcF3Tc5Xq7nsadaTy5eVbn27Dn3XB9TAmvZHCPPJavYRzSNmx18Ah2LIXGJ2NloB61Oqh5zKsgPO zUycnRQaoAXzM5z5GO4X6oTAkno.1kprS.YKHr0vzNMJ8xwLhAxgtNgnEuB1FjaT2vtUhxMQOJGV ZBxdgF_69u8AGY57N4dVUyuPjQ.RrujdNHdbvTiTEsrIw5WjWaHqkafyjMlHUjIyThDeDs3yYfUr UO3i8.3WF7TwyrNvKS4C1PIGg7XLjFQjTll01IJxKjdiNCAfQU.vs8jw6f7Cipb.xmNpnLckRfcZ Y1wyzGxPemjYzTPFMhNMavQIhetKYk.Cc5BkNbg3u8rEFbZt5txJvTrO7KUTKYtUCUTVd4tcCXYp PDrcqCSCQjOeXE4gAOVKJAVTnY7JJyWK5nYc2Y0urqbSG7Ipw4vpx472r8Zy9QTAguF_xYHbJAu6 o4LbvqxWxfvOrrb.kX.1.uL9Gda7j7uSd
Received: from sonic.gate.mail.ne1.yahoo.com by sonic311.consmr.mail.ne1.yahoo.com with HTTP; Mon, 22 Jul 2019 11:03:39 +0000
Date: Mon, 22 Jul 2019 11:03:34 +0000
From: Tomek Stojecki <tstojecki@yahoo.com>
To: Leo Tohill <leotohill@gmail.com>, David Waite <david@alkaline-solutions.com>, Brock Allen <brockallen@gmail.com>
Cc: oauth@ietf.org
Message-ID: <1459948558.729107.1563793414827@mail.yahoo.com>
In-Reply-To: <170d4112-fc89-4f6b-8f10-126baf62a193@getmailbird.com>
References: <CABw+FcsH3CHmFphz5DD6aDeEqKLxbQhY14kdrXCVY0WXQN6PuQ@mail.gmail.com> <AEC7268A-D22D-41DA-8609-E7D2DD3B290C@alkaline-solutions.com> <624da319-b19c-053b-4fd0-048c0e2b8fb9@aol.com> <CAGBSGjp8m+V+i-sNnrLmu7DR_Bo1uv0iGkW2o7hiqUWw8Sc7qg@mail.gmail.com> <138cbde0-11b7-8f23-1028-3af0846b5a01@aol.com> <CAGBSGjq=SFG5nfOA6nwRsEQY576dsJDAHaL9UH4Yh7AAtOMu5Q@mail.gmail.com> <D676DDDE-20FE-4004-8E3F-124A560A1C20@mit.edu> <0A6F7761-9376-43EE-9B9C-0554812E13B7@forgerock.com> <CABw+Fcus9e5Et5aU_70tJwoX5BVfWaFbiJ+f4UgKe2zr46UPvQ@mail.gmail.com> <20C9E1B6-E497-41C9-9590-F68DD747E401@alkaline-solutions.com> <CABw+FcspWmjRGRuNcudCivuj=GmbWR0sA_s5oNZJFc8Jc6nToQ@mail.gmail.com> <170d4112-fc89-4f6b-8f10-126baf62a193@getmailbird.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: WebService/1.1.13991 YMailNorrin Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/tJpPHVoaJE9A_XbMhCNFDPnHnpc>
Subject: Re: [OAUTH-WG] Refresh tokens
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Jul 2019 11:03:46 -0000

> FWIW, in addition, those can be used together -- sliding & absolute. 

Azure AD does both at this point. They used to do 90 days absolute, now it is a sliding, 72 hours by default I believe. 

Good discussion overall, would this be a good summary for the type of a client the spec is for:

SHOULD NOT use refresh tokens unless the token endpoint mirrors user authentication or the OP supports expiration, rotation and revocation of refresh tokens

On Sunday, July 21, 2019, 04:45:07 PM GMT+2, Brock Allen <brockallen@gmail.com> wrote: 

> IdentityServer allows a choice of behavior on refresh token expiration time. It can have a absolute expiration time, or use a sliding window.

FWIW, in addition, those can be used together -- sliding & absolute. Finally, refresh tokens can be re-use or one-time use only. These are all per-client settings.

-Brock


_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

v2.48.1 | Report a Bug | By Email | System Status