Please find below some thoughts related to https://github.com/KantaraInitiative/wg-uma/issues/294. The RFC 7800 [1] presents a concrete approach, which defines how to communicate the confirmation key information in JWTs. This is applicable in any case where the RPT itself is a self-contained access token (which is an JWT). In other words, as per RFC 7800 the authorization server (or the token issuer) embeds the confirmation key (associated with the client) (or a reference to the confirmation key) in the JWT (which signed by the issuer. The confirmation key can be either symmetric or asymmetric proof of procession key. If it's asymmetric, then the public key information is communicated in the JWT issued by the authorization server. If it's symmetric, then the confirmation key is encrypted by a key known to the resource server. In either case, the JWT can also communicate the confirmation key by reference, using the kid or the jku. What is not discussed in the RFC 7800? 1. It does not talk about how the key information is established between the client and the authorization server. 2. It does not talk about how the client proves its procession of the confirmation key. The draft spec OAuth 2.0 Proof-of-Possession: Authorization Server to Client Key Distribution [2] addresses how key distribution happens between the client and the authorization server. The draft spec A Method for Signing HTTP Requests for OAuth [3] can be used as way for the client to prove the procession of the key. *Overall the architecture to build PoP tokens (or RPT in UMA) is in development - and UMA may need not to do any thing specific to itself - but rather provide recommendations and pointers.* Thoughts please... [1]: https://tools.ietf.org/html/rfc7800 [2]: https://tools.ietf.org/html/draft-ietf-oauth-pop-key-distribution-03 [3]: https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03 -- Thanks & Regards, Prabath Twitter : @prabath LinkedIn : http://www.linkedin.com/in/prabathsiriwardena Mobile : +1 650 625 7950 On Wed, Apr 5, 2017 at 4:41 AM, Eve Maler <eve@xmlgrrl.com> wrote:
Instead, I'd like to ask people to review the specs and open issues, and prepare final comments in preparation for next week; we said our "WG last call" would end by Tue, Apr 11.
Our current substantive open issues look like this:
- *#290 <https://github.com/KantaraInitiative/wg-uma/issues/290> (Generality of RReg spec?) and #296 <https://github.com/KantaraInitiative/wg-uma/issues/296> (Out-of-the-box profiling for tight AS-RS coupling):* This is a biggie. Current proposal (for which I hope to have some more details soon) is to consider a different way of modularizing the specs. A group consisting of me, Mark L, Maciej, Andi, and Cigdem talked about this further in London on Monday and there was a pretty strongly favorable impression. - *#294 <https://github.com/KantaraInitiative/wg-uma/issues/294> (Consider a proof-of-possession option for the RPT):* This topic is broader by now, including token binding etc., and we suspect this all might "just work". This just needs to be analyzed a bit. *Prabath*, you were going to take a look -- can you, please, and write up? - *#295 <https://github.com/KantaraInitiative/wg-uma/issues/295> (When a requesting party needs to withdraw their access):* This touches on downscoping and token revocation, and thus could use some analysis. *Justin*, this could use your eyeballs in particular, but it's really for *everyone*. - *#298 <https://github.com/KantaraInitiative/wg-uma/issues/298> (Reconsider whether ticket should be on all redirect-back AS responses):* Justin and Cigdem have been commenting on this one and seem to have consensus so far that we're okay, but it could use more eyeballs. But another related issue has come up about the appropriateness of not_authorized as an error that we could consider.
For anyone interested, I'd like to propose an ad hoc meeting next *Tue, Apr 11* at 9am PT to discuss these issues (and any others people report), in addition to our regular *Thu, Apr 13* call.
I'll make the changes to the calendar right now.
*Eve Maler*Cell +1 425.345.6756 <+1%20425-345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
-- Thanks & Regards, Prabath Twitter : @prabath LinkedIn : http://www.linkedin.com/in/prabathsiriwardena Mobile : +1 650 625 7950 http://facilelogin.com