Re: [Txauth] WG Review: Grant Negotiation and Authorization Protocol (gnap)

[Dick Hardt <[e-mail]>]

Denis, thanks for sharing your thoughts, some clarifications on your
statements inserted:

On Fri, Jun 26, 2020 at 9:42 AM Denis <[e-mail]> wrote:
<snip>

> *New proposed charter*
>
> <snip>

>
> Resource servers inform their clients about which access token formats are
> acceptable and depending upon the king of operation
> that is requested, which kind of attributes are needed and from which ASs
> that my be obtained.
>
> While at times this may be appropriate, at other times disclosing the
attributes the RS requires is not needed by the client. For example, an
enterprise client accessing a resource does not need to know which groups a
user belongs to, but the RS may require that to determine if the user
running the client has access.

>
> A major difference with OAuth 2.0 is that there is no bilateral trust
> relationship between an authorization server and a resource server:
> for a given category of attributes, a resource server may trust one or
> more authorization servers. Another major difference with OAuth 2.0.
> is that the content of an attributes token is meant to be accessible to
> the client.
>
> This is not how OAuth 2.0 works. See slides 7 and 8 from my original IETF
presentation on what became OAuth 2.0

https://www.slideshare.net/gueste648b/ietf-77-oauth-wrap-presentation

The AS may not even know who the RS (or PR in the slides) is.

<snip>

>
> I got rid of the word "delegation": the client does not delegate anything
> to an authorization server. If it would, this would mean that the
> authorization server
> would be able to act as the client and could know everything that the
> client will do, which comes into contradiction with the user's privacy.
>

The above is not true.

The Resource Owner is delegating access control to the AS in authorization
use cases.

The client is may be delegating user authentication to the AS in identity
claim use cases.

The AS can act as the client in many OAuth deployments, as the access token
is a bearer token. That does not mean the AS knows what the client is
doing.

/Dick

ᐧ