[Wimse] Re: Token Exchange design team update

["Saxe, Dean" <[e-mail]>]

That sounds correct.  In the specific example, I see two different token translations/exchanges happening.  The first is through the OIDC discovery mechanism.  The second is through a bespoke AWS mechanism (AWS STS) to return the temporary security credentials.

The important thing to note is that translations from token type A to token type B need to be more clearly defined as profiles to ensure that there are defined patterns for how to translate from A to B to ensure consistent mechanisms for translation, and a clear understanding of what, if anything, is lost.

I hope that helps!

-dhs
-- 
Dean H. Saxe, CIDPRO <https://idpro.org/cidpro/> (he/him) 
Senior Security Engineer, AWS Identity Security Team | Amazon Web Services (AWS) 
E: [e-mail] <mailto:[e-mail]> | M: 206-659-7293 <tel:[phone]> 




On 6/13/24, 12:09 PM, "John Kemp" <[e-mail] <mailto:[e-mail]>> wrote:


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.






On 6/13/24 14:02, Saxe, Dean wrote:
> Second, we have come to the conclusion that token exchange has a
> distinct meaning due to the use of the term in RFC 8693
> <https://datatracker.ietf.org/doc/html/rfc8693> <https://datatracker.ietf.org/doc/html/rfc8693&gt;>. Recognizing that WIMSE
> is broader than OAuth 2.0 and that there may be exchanges that are lossy
> between different token types, we have embraced the idea of “token
> translation” as a term to express that there may be information “lost in
> translation” in such exchanges. Where WIMSE can use the existing
> mechanisms in RFC 8693, we will continue to refer to that as “token
> exchange”. In my opinion, token translation is a superset which
> includes the existing OAuth Token Exchange protocol. I look forward to
> broader discussion on this idea with the WIMSE WG.


Just an attempt to understand this concretely, I thought I'd use the
SPIRE-OIDC-AWSIAM example from the docs:


1. A SPIRE SVID JWT is issued to the workload at some point prior to the
use of AWS S3, just via the normal SPIRE mechanisms.


2. Once OIDC discovery + IdP in AWS is setup, via OIDC discovery, the
SPIRE OIDC provider provides an OpenID Connect ID Token to the AWS IdP,
representing the workload, with the SVID url as its 'sub'. So this has
been an actual token exchange (of a kind) from one format of JWT to
another (let's forget there's probably barely any translation needed there).


3. Once the token has been obtained by the client, it can be used to go
to S3, along with the request to 'assume role' based on that token.


4. The JWT is "translated" (and I think translation sounds more accurate
than "exchange" here) to an IAM role (which concretely means AWS
"temporary credentials" - but the client application never sees those
effectively, so there is no "exchange" as such.


So the overall protocol requires both an actual token exchange (not
mediated by the client) and a translation.


Did I get that right (in which case, I agree with "translation" being
needed?)


Cheers, - johnk


--
Wimse mailing list -- [e-mail] <mailto:[e-mail]>
To unsubscribe send an email to [e-mail] <mailto:[e-mail]>