[Wimse] Service to service, X509, TLS, and sadness

[Watson Ladd <[e-mail]>]

Dear WIMSE,

I think there's some things to think about in the service to service
document. This isn't surprising: TLS and X509 are complex, don't fit
together well, and adding something else on top gets very complex. I
certainly am not as well versed in some of this as I fear some are, so
this is much more a conversation starter.

First It's not clear to me that using a URI SAN is the right choice. a
SAN may use otherName which has a type defined by an OID and then
anything you want for that type. OIDs are extensible, so we could
standardize one here for this. This would make it easier to know what
sort of certificate is in play when debugging and avoids accidents
with other sorts of issuance from older CAs. Putting the DNS label in
works on K8S where it's known what the names used will be, but I think
we have to worry about namespaces if we used the short ones.

Secondly, not clear to me that trust domain is the only thing that
must be matched here. Surely we don't want clients to send requests to
incorrect services.

Thirdly, the dichotomy presented between TLS and HTTP layer routing is
incorrect. It's possible to have load balancers convey client
authentication information to servers. While I understand not every
deployment scenario works for this, plenty can. Making that work
though depends on a certain amount of signaling at the TLS Client
Hello layer, and that doesn't exist for this type of client info, but
it's easy enough to specify.

We also need to consider how an X509 and a HTTP auth/JWT based
environment interact, and what happens with the vast complexity of
things X509 allows. If we're just going to give every service both if
they need to interop, that would be sad. It's also not clear to me
that if we need to add additional things to tokens the X509 layer can
handle them.

I think its worth considering using WIMSE as the authentication for
TLS without an X509 wrapper: TLS does have this extension point, but
library support is less than ideal. If we can't do that, then I think
we might need to drop X509 because things just won't work well that we
want to put in.

Sincerely,
Watson

-- 
Astra mortemque praestare gradatim