[GNAP] GNAP RS-AS interaction questions

[Erin Shepherd <[e-mail]>]

Hi,

I’ve been looking at implementing GNAP with some interest (on the whole I find it a very readable and straight-forward specification!) but I’ve spotted a few of areas of difficulty:

1. The GNAP-RS spec says, in the introspection response

  iss (string): REQUIRED. Grant endpoint URL of the AS that issued this token.

This seems a little limiting? Let’s say I have an existing OAuth IDP that I’m adding GNAP support to; it seems that the spec basically requires that a GNAP RS will see different sub+iss values from an OAuth RS?


2. The GNAP-RS spec lists five different token formats that an AS can declare support for but provides no information regarding the contents or validation of those tokens. It seems like the only way (within the written text of the specification) to validate a token would be to submit it to the introspection endpoint, which seems like it rather defeats the purpose of knowing the format.

I would have liked to see some guidance on

* How to locate the AS’ token signing keys for "jwt-signed” access tokens
* How to agree encryption keys for "jwt-encrypted” access tokens
* Required JWT claims & claim values
* Similar for the other formats (with which I have less experience)

i.e. something along the lines of RFC 9068 I guess (That could perhaps even have been referenced directly, with minor differences?

3. As far as I can tell, there’s no way for the AS to return subject information to the RS beyond the fixed set of introspection response values?

I would have expected something similar to the Subject Information defined in GNAP s3.4 to be returned (or requitable)

4. Its unfortunate that the discovery URI was not defined to work by splicing /.well-known/gnap-as-rs into the start of the path segment in the same way as OAuth Authorisation Server Metadata is. Oh well, such is life, it would appear.

- Erin