Re: [Txauth] Use Case: Directed Tokens

[Dick Hardt <[e-mail]>]

I agree it is not always true, sorry I did not make that clear.

My statement is that OAuth 2.0 does not require the AS to have knowledge of
the RS.


On Thu, Jul 2, 2020 at 10:56 AM Tom Jones <[e-mail]>
wrote:

> Dick, the statement about the AS and RS is not always true. In federations
> we are always concerned that information is not leaked outside the approved
> parties and the AS messages will likely be encrypted for the sole use of
> the RS.
> Peace ..tom
>
>
> On Thu, Jul 2, 2020 at 10:44 AM Dick Hardt <[e-mail]> wrote:
>
>> Apologies for the delayed response:
>>
>> On Fri, Jun 26, 2020 at 9:04 AM Denis <[e-mail]> wrote:
>>
>>> The principle where a RS would only have relationships with one AS would
>>> make the model non scalable.
>>> It would prevent to get attributes from two different ASs,  for
>>> example:
>>> identity attributes from a bank and a master degree diploma from a
>>> university.
>>>
>>
>> Where do you see that the RS can have a relationship with only one AS?
>>
>>
>>>
>>> For privacy reasons, every AS should know as little as possible about
>>> the interactions between a client and multiple RSs.
>>> It is even possible that this goes as little as knowing *nothing at all*
>>> .
>>>
>>
>> OAuth 2.0 works this way now.
>>
>>
>>>
>>> The OAuth 2.0 assumption where the AS is in a position to know all the
>>> interactions of a given user has with all the RSs
>>> that an AS server has a relationship with should not be re-iterated.
>>>
>>
>> I am still confused why you think the AS knows anything abou the
>> interactions a given use has with all the RSs. The AS knows which clients
>> the user is using, but does not need to have any knowledge of which RSs a
>> client is accessing.
>>
>>
>> The AS does not need to know anything about the RS. The RS clearly needs
>> to trust the AS, as it is trusting the access granted by the AS to the
>> client, but it is unidirectional trust between the RS and the AS.
>>
>> /Dick
>>
>