Re: [OAUTH-WG] Benjamin Kaduk's No Objection on draft-ietf-oauth-jwsreq-26: (with COMMENT)

Hi Mike, Nat,

I thought we would go as far as making these normative requirements

   - if the Request Object includes a sub claim with the value of the
   client_id the AS MUST reject the request
   - if the Request Object is explicitly typed (typ) its value MUST be ...

First rejects client assertions to be passed as Request Objects. Second
rejects all future typed JWT profiles from being used as Request Objects
without worrying about the claims they may or may not contain.

Or is that breaking?

S pozdravem,
*Filip Skokan*

On Fri, 14 Aug 2020 at 00:59, Mike Jones <Michael.Jones=
40microsoft.com@dmarc.ietf.org> wrote:

> At Nat's request, I've created a pull request addressing Cross-JWT
> Confusion security considerations.  It addresses both Brian's comment and
> the IESG comments about explicit typing.  See the full PR at
> https://bitbucket.org/Nat/oauth-jwsreq/pull-requests/10.  See the source
> diffs at
> https://bitbucket.org/Nat/oauth-jwsreq/pull-requests/10/address-iesg-and-working-group-comments/diff#chg-draft-ietf-oauth-jwsreq.xml.
> Please review!
>
> This is only the first commit, albeit, one that addresses some of the must
> substantive issues.  More commits will follow addressing additional IESG
> comments.
>
>                                 -- Mike
>
> -----Original Message-----
> From: OAuth <oauth-bounces@ietf.org> On Behalf Of Benjamin Kaduk
> Sent: Thursday, August 13, 2020 2:59 PM
> To: Brian Campbell <bcampbell@pingidentity.com>
> Cc: draft-ietf-oauth-jwsreq@ietf.org; oauth-chairs@ietf.org; The IESG <
> iesg@ietf.org>; oauth <oauth@ietf.org>
> Subject: Re: [OAUTH-WG] Benjamin Kaduk's No Objection on
> draft-ietf-oauth-jwsreq-26: (with COMMENT)
>
> Oops, that's my bad.  Thanks for the correction -- I've linked to your
> message in the datatracker (but didn't bother to have the datatracker send
> a third copy of my updated-again ballot position).
>
> -Ben
>
> On Thu, Aug 13, 2020 at 03:00:33PM -0600, Brian Campbell wrote:
> > While some discussion of why explicit typing was not used might be
> > useful to have, that thread started with a request for security
> > considerations prohibiting use of the "sub" with a client ID value.
> > Because such a request JWT could be repurposed for JWT client
> > authentication. And explicit typing wouldn't help in that situation.
> >
> > On Tue, Aug 11, 2020 at 2:50 PM Benjamin Kaduk via Datatracker <
> > noreply@ietf.org> wrote:
> >
> > >
> > > --------------------------------------------------------------------
> > > --
> > > COMMENT:
> > > --------------------------------------------------------------------
> > > --
> > >
> > > [updated to note that, per
> > > https://mailarchive.ietf.org/arch/msg/oauth/Lqu15MJikyZrXZo5qsTPK2o0
> > > eaE/ and the JWT BCP (RFC 8725), some discussion of why explicit
> > > typing is not used would be in order]
> > >
> > >
> >
> > --
> > _CONFIDENTIALITY NOTICE: This email may contain confidential and
> > privileged material for the sole use of the intended recipient(s). Any
> > review, use, distribution or disclosure by others is strictly
> > prohibited.  If you have received this communication in error, please
> > notify the sender immediately by e-mail and delete the message and any
> > file attachments from your computer. Thank you._
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>