Re: [Txauth] Use Case: Directed Tokens

[Dick Hardt <[e-mail]>]

While the scopes used in some implementations imply the RS, there is
nothing in OAuth 2.0 that requires the scope to imply the RS.

When you use your driver's license to prove your age at a liquor store, it
is unidirectional trust. The issuer likely has no relationship with the
audience.

I think you are contemplating claims rather than tokens if the driver's
license example is what you are contemplating.




On Fri, Jul 3, 2020 at 2:19 AM Denis <[e-mail]> wrote:

> Hello  Dick,
>
> I agree it is not always true, sorry I did not make that clear.
>
> My statement is that OAuth 2.0 does not require the AS to have
> knowledge of the RS.
>
> As soon as the scope parameter is being used, then the AS has a prior
> knowledge of the RS.
> When the scope parameter is not used, then the client has no ability to
> modulate the attributes.
>
> Even when the AS has a no prior knowledge of the RS, when the access token
> is targeted to a given RS,
> then the AS has the knowledge of which RS is likely to be accessed by the
> client.
>
> While it may be interesting to list some of the limitations of OAuth 2.0,
> it is much more important
> to focus on the characteristics we would like to support with GNAP ...
> and to mention them in the charter.
>
> Denis
>
>
> On Thu, Jul 2, 2020 at 10:56 AM Tom Jones <[e-mail]>
> wrote:
>
>> Dick, the statement about the AS and RS is not always true. In
>> federations we are always concerned that information is not leaked outside
>> the approved parties and the AS messages will likely be encrypted for the
>> sole use of the RS.
>> Peace ..tom
>>
>>
>> On Thu, Jul 2, 2020 at 10:44 AM Dick Hardt <[e-mail]> wrote:
>>
>>> Apologies for the delayed response:
>>>
>>> On Fri, Jun 26, 2020 at 9:04 AM Denis <[e-mail]> wrote:
>>>
>>>> The principle where a RS would only have relationships with one AS
>>>> would make the model non scalable.
>>>> It would prevent to get attributes from two different ASs,  for
>>>> example:
>>>> identity attributes from a bank and a master degree diploma from a
>>>> university.
>>>>
>>>
>>> Where do you see that the RS can have a relationship with only one AS?
>>>
>>>
>>>>
>>>> For privacy reasons, every AS should know as little as possible about
>>>> the interactions between a client and multiple RSs.
>>>> It is even possible that this goes as little as knowing *nothing at
>>>> all*.
>>>>
>>>
>>> OAuth 2.0 works this way now.
>>>
>>>
>>>>
>>>> The OAuth 2.0 assumption where the AS is in a position to know all the
>>>> interactions of a given user has with all the RSs
>>>> that an AS server has a relationship with should not be re-iterated.
>>>>
>>>
>>> I am still confused why you think the AS knows anything abou the
>>> interactions a given use has with all the RSs. The AS knows which clients
>>> the user is using, but does not need to have any knowledge of which RSs a
>>> client is accessing.
>>>
>>>
>>> The AS does not need to know anything about the RS. The RS clearly needs
>>> to trust the AS, as it is trusting the access granted by the AS to the
>>> client, but it is unidirectional trust between the RS and the AS.
>>>
>>> /Dick
>>>
>>
>