Re: [Txauth] Turning polymorphism up to 11 (P11)

[Yaron Sheffer <[e-mail]>]

<no hats>

 

The issue of polymorphism is somewhat religious, similarly to strong vs. weak typing in programming languages, and I am of the non-polymorphic (unimorphic?) persuasion. Specifically when it comes to security protocols, where a recipient misunderstanding a value can easily result in a vulnerability.

 

With respect to a schema language, IMO the fact that it is difficult to express some polymorphic constructs in JSON Schema is a reason to avoid these constructs, rather than go looking for a different schema language.

 

Thanks,

                Yaron

 

From: Txauth <[e-mail]> on behalf of Dick Hardt <[e-mail]>
Date: Monday, July 13, 2020 at 03:56
To: <[e-mail]>
Subject: Re: [Txauth] Turning polymorphism up to 11 (P11)

 

For those not familiar with "turning up to 11" https://en.wikipedia.org/wiki/Up_to_eleven

 

A counter argument to all of this polymorphism is that the AS is sending back the granted authorization. While pushing type detection to the AS to provide a simpler interface for the Client, it seems counterproductive if the Client has to do the same. A consistent response from the AS will be simpler for the Client, but would then also be different then what the Client originally requested from the GS.

 

On Fri, Jul 10, 2020 at 6:01 PM Dick Hardt <[e-mail]> wrote:

Taking Justin's model of strings being shortened versions of OAuth scopes, adding in the "type" property from RAR, and defining a default type, we *could* add a bunch of polymorphism. (I have not implemented the code below, but it looks doable assuming I have not overloaded a type in the same context)

 

/Dick

 

 

Let's start with a request for 2 authorizations using OAuth scopes, one for writing and the other for reading:

 

(1)

{

    "authorizations": {

        "writer": [

            { 

                "type": "oauth_scope",

                "scope": ["create","update","delete"]

            }

        ],

        "reader": [

            { 

                "type": "oauth_scope",

                "scope": ["read","list"]

            }

        ]

    }

}

 

We can ask for just one token with all the same capabilities:

(2)

{

    "authorizations": [

        { 

            "type": "oauth_scope",

            "scope": ["create","update","delete"]

        },

        { 

            "type": "oauth_scope",

            "scope": ["read","list"]

        }

    ]

}

 

Of course (2) can be simplified as:

(3)

{

    "authorizations": [

        { 

            "type": "oauth_scope",

            "scope": ["create","update","delete","read","list"]

        }

    ]

}

 

Now let's say that in "oauth_scope", the array of scopes can also be a space separated string. So the following is equivalent:

(4)

{

    "authorizations": [

        { 

            "type": "oauth_scope",

            "scope": "create update delete read list"

        }

    ]

}

 

Now let's say that the "oauth_scope" type is the default, so we can express it as:

(5)

{

    "authorizations": ["create","update","delete","read","list"]

}

 

Or use a space separated string instead of an array:

(6)

{

    "authorizations": "create update delete read list"

}

 

In summary, (2) - (6) will give the exact same result.

 

Let's add another authorization type to the request, "customer_information":

(7)

{

    "authorizations": [

        "create update delete read list",

        {

            "type": "customer_information",

            "locations": [

                "https://example.com/customers",

            ],

            "actions": [

                "read"

            ],

            "datatypes": [

                "contacts",

                "photos"

            ]

        }

    ]

}

 

And the space separated strings can be turned into individual strings and we have the equivalent request:

(8)

{

    "authorizations": [

        "create",

        "update",

        "delete",

        "read",

        "list",

        {

            "type": "customer_information",

            "locations": [

                "https://example.com/customers",

            ],

            "actions": [

                "read"

            ],

            "datatypes": [

                "contacts",

                "photos"

            ]

        }

    ]

}

 

Let's go back to our first example, and ask for 3 separate tokens:

(9)

{

    "authorizations": {

        "writer": "create update delete",

        "reader": "read list",

        "customer": [

            {

                "type": "customer_information",

                "locations": [

                    "https://example.com/customers",

                ],

                "actions": [

                    "read"

                ],

                "datatypes": [

                    "contacts",

                    "photos"

                ]

            }    

        ]

    }

}

 

In a multi token request, if there is only one item in the array, we can shorten (9) to the following:

(10)

{

    "authorizations": {

        "writer": "create update delete",

        "reader": "read list",

        "customer": {

            "type": "customer_information",

            "locations": [

                "https://example.com/customers",

            ],

            "actions": [

                "read"

            ],

            "datatypes": [

                "contacts",

                "photos"

            ]

        }    

    }

}

-- Txauth mailing list [e-mail] https://www.ietf.org/mailman/listinfo/txauth