Re: [Txauth] Use Case: Directed Tokens

[Denis <[e-mail]>]

Hello Dick,

> Apologies for the delayed response:
>
> On Fri, Jun 26, 2020 at 9:04 AM Denis <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     The principle where a RS would only have relationships with one AS
>     would make the model non scalable.
>     It would prevent to get attributes from two different ASs,  for
>     example:
>     identity attributes from a bank and a master degree diploma from a
>     university.
>
>
> Where do you see that the RS can have a relationship with only one AS?

In general, a RS can trust one or more AS, but this does not necessarily 
means that a RS and an AS have a (bi-)lateral relationship.
The current text of the charter is vague enough so that no one can 
really know. The text of the charter should be made more explicit.

>     For privacy reasons, every AS should know as little as possible
>     about the interactions between a client and multiple RSs.
>     It is even possible that this goes as little as knowing /nothing
>     at all/.
>
>
> OAuth 2.0 works this way now.

I don't think so. Today, the only way to request specific attributes in 
OAuth 2.0. is to use the scope/RS pair which means that:

  * the AS knows to which RS the access token is intended, and
  * the AS and the RS have a bi-lateral relationship to know what the
    scope means.

>  The OAuth 2.0 assumption where the AS is in a position to know all 
> the interactions of a given user has with all the RSs
> that an AS server has a relationship with should not be re-iterated.
>
> I am still confused why you think the AS knows anything about the 
> interactions a given user has with all the RSs.
> The AS knows which clients the user is using, but does not need to 
> have any knowledge of which RSs a client is accessing.

In OAuth 2.0, as soon as, for security reasons, an access token is 
targeted then the AS is able to know who the target is.
In GNAP, while not preventing this, we should have the ability to hide 
to the AS who the RS target is.

>  The AS does not need to know anything about the RS. The RS clearly 
> needs to trust the AS, as it is trusting the access granted by the AS 
> to the client,
> but it is /unidirectional trust/ between the RS and the AS.

"unidirectional trust" is not an appropriate wording. Since trust is 
between an entity A and an entity B for some kind of operation C
it does not presume what may happen in terms of trust between entity B 
and entity A. Nevertheless, it looks like that we are in agreement on 
that point.

Denis

>
> /Dick