[Wimse] Re: Token Exchange design team update

["Saxe, Dean" <[e-mail]>]

Thank you for the update, Yaroslav.  I apologize for the delay in my own update, I was out of the office for a few days.

Following up on the note below, the design team has not yet achieved consensus, but we have had good discussions that helped us set a direction.  The team identified a set of eight requirements for a token translation mechanism:


  *   Token Format Change
  *   Token Encoding Change
  *   Changes to Cryptographic Properties of the Token
  *   Embedding One Token in Another
  *   Change of Embedded Context in Token
  *   Change of Validity Constraint of the Token
  *   Changing or Adding Subjects of the Token
  *   Adding Sender Constraint to the Token

Second, we have come to the conclusion that token exchange has a distinct meaning due to the use of the term in RFC 8693<https://datatracker.ietf.org/doc/html/rfc8693>.  Recognizing that WIMSE is broader than OAuth 2.0 and that there may be exchanges that are lossy between different token types, we have embraced the idea of “token translation” as a term to express that there may be information “lost in translation” in such exchanges.  Where WIMSE can use the existing mechanisms in RFC 8693, we will continue to refer to that as “token exchange”.  In my opinion, token translation is a superset which includes the existing OAuth Token Exchange protocol.  I look forward to broader discussion on this idea with the WIMSE WG.

We have two documents in progress as noted in Yaroslav’s note.  First, is the requirements and use cases found at https://github.com/yaroslavros/wimse-tokentranslation-requirements. Second, there’s a repository for the WIMSE Token Exchange and Translation draft available at https://github.com/dhs-aws/wimse-token-exch-design-team.  I look forward to your feedback as we continue to work on the drafts in preparation for IETF120.

Thanks to my partners in the design team, Yaroslav Rosomakho, George Fletcher, Andrii Deinega, and Dmitry Izumskiy, I look forward to continuing to work together.  As well, thank you to the WIMSE WG chairs, Justin Richer and Pieter Kasselman, for their guidance over the past ~8 weeks.

-dhs

--
Dean H. Saxe, CIDPRO<https://idpro.org/cidpro/> (he/him)
Senior Security Engineer, AWS Identity Security Team | Amazon Web Services (AWS)
E: [e-mail]<mailto:[e-mail]> | M: 206-659-7293<tel:[phone]>

From: Yaroslav Rosomakho <yrosomakho=[e-mail]>
Date: Tuesday, June 11, 2024 at 9:52 AM
To: "[e-mail]" <[e-mail]>
Subject: [EXTERNAL] [Wimse] Token Exchange design team update


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.


Dear working group,

After many weekly meetings, the Token Exchange design team is progressing on two documents: Token Translation Requirements and Token Translation Abstract and Introduction.

The repository for requirements document is now public and available at https://github.com/yaroslavros/wimse-tokentranslation-requirements. We are still actively working on this document and plan to submit the first draft by July 8th. Looking forward to feedback and suggestions on the list or via GitHub issues.

Abstract and Introduction document repo will be shared shortly.

Thanks!

Best Regards,
Yaroslav on behalf of Andrii, Dean, Dmitry and George