Re: [Txauth] Possible Use Case for GNAP

Hey, we have some (sort of) similar cases and requirements today which we
have solved by implementing the token-exchange spec.
It certainly doesn’t solve all the issues discussed here, but for
traceability it does the job for us. Being able to express an
“authorization stack-trace” and the original user identity is both useful
and required  in our case.

-Steinar

man. 6. jul. 2020 kl. 16:34 skrev David Pyke <david.pyke=
40readycomputing.com@dmarc.ietf.org>:

> Those are exactly the issues I was facing.  While I can make the hops
> independent, they need to be chained so that everything is traceable.
> It's possible but ugly with OAuth.
> On 2020-07-02 3:34 p.m., Justin Richer wrote:
>
> If we look at each hop as a separately authorized request, could we define
> them in a way that they’re chained from each other down the line? Maybe it
> would be possible for the root HIN to get a new token for each of the
> downstream HINs, but this new token is in the context of the first one
>
> --
>
> *David Pyke*
>
> Manager, Strategic Consulting
>
>
> ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> [image: Logo] <http://www.readycomputing.com/>
>
> [image: LinkedIn icon] <https://www.linkedin.com/company/ready-computing> [image:
> Twitter icon] <https://twitter.com/ready_computing?lang=en> [image:
> Youtbue icon] <https://www.youtube.com/channel/UCtA7SflMXNTkY0MWL-79LDQ>
>
> Office: +1 212 877 3307 x5001
>
> * david.pyke@readycomputing.com <david.pyke@readycomputing.com>*
>
> * www.readycomputing.com <http://www.readycomputing.com/>*
>
> 150 Beekman Street, Floor 3, New York, NY 10038
> <https://www.google.com/maps/search/150%0D%0A++++++++++++++++++++++++++++Beekman+Street,+Floor+3,+New+York,+NY+10038?entry=gmail&source=g>
>
> The information in this e-mail communication together with any attachments
> is intended only for the person or entity to which it is addressed and may
> contain confidential and/or privileged material. If you are not the
> intended recipient of this communication, please notify us immediately. Any
> views expressed in this communication are those of the sender, unless
> otherwise specifically stated. Ready Computing does not represent, warrant
> or guarantee that the integrity of this communication has been maintained
> or the communication is free of errors, virus or interference.
>
> This is not a secure transmission. The information contained in this
> transmission is highly prohibited from containing privileged and
> confidential information, including patient information protected by
> federal and state privacy laws. It is intended only for the use of the
> person(s) named above. If you are not the intended recipient, you are
> hereby notified that any review, dissemination, distribution, or
> duplication of this communication is strictly prohibited. If you are not
> the intended recipient, please contact the sender by reply email and
> destroy all copies of the original message. --
> Txauth mailing list
> Txauth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>
-- 
Vennlig hilsen

Steinar Noem
Partner Udelt AS
Systemutvikler

| steinar@udelt.no | hei@udelt.no  | +47 955 21 620 | www.udelt.no |