<html><head><base href="x-msg://698/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Extracting a key from a certificate is not that hard, to make a JWK out of it. <div><br></div><div>We can likely automate that. People who want to support x509 are free to do that it is just not mandatory for the client. For the basic client using the code flow there is no MTI, for the implicit flow JWK is MTI if you want general support. I suppose if a client just wants to talk to a specific IDP it could just do x509 if that is supported.</div><div><br></div><div>The options are.</div><div>1 Client must support both and server chooses</div><div>2 Server must support both and client chooses</div><div>3 Server must support one and the other is optional.</div><div><br></div><div>Tony are you saying you prefer 1 or 2, or 3 your preference but making x.509 the default.</div><div><br></div><div>There are advantages and disadvantages to picking JWK as the default. </div><div><br></div><div>It is true that most common tools like openSSL easily produce self signed certificates.</div><div>On the other hand they expire and create run time issues later because some people may try and do PKIX processing on them. </div><div><br></div><div>This is a continual debate in SAML over raw keys vs certificates. Many federations think raw keys cause less support issues over time.</div><div><br></div><div>Thoughts?</div><div><br></div><div>John B.</div><div><div><div>On 2012-07-26, at 9:43 PM, Anthony Nadalin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">This creates problems with folks that already have a PIK infrastructure and want to use existing keys<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Edmund Jay [mailto:ejay@mgi1.com]<span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 26, 2012 3:11 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Anthony Nadalin; <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>; <a href="mailto:openid-connect-interop@googlegroups.com">openid-connect-interop@googlegroups.com</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] Mandatory JWK Support for OpenID Connect<o:p></o:p></span></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">This is in reference to the open issue # 633 at<span class="Apple-converted-space"> </span><a href="http://hg.openid.net/connect/issue/633/messages-42-jwk-and-x509-format-support" target="_blank" style="color: blue; text-decoration: underline; ">http://hg.openid.net/connect/issue/633/messages-42-jwk-and-x509-format-support</a><br>The specs currently support x509 and JWK format for publishing public keys but is silent on which must be supported.<br>There may be interop problems related to cryptographic aspects of OpenID due to lack of common support between client and server.<br><br>-- Edmund<o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><o:p> </o:p></span></div><div><div class="MsoNormal" align="center" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-align: center; "><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><hr size="1" width="100%" align="center"></span></div><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>Anthony Nadalin <<a href="mailto:tonynad@microsoft.com" style="color: blue; text-decoration: underline; ">tonynad@microsoft.com</a>><br><b>To:</b><span class="Apple-converted-space"> </span>Edmund Jay <<a href="mailto:ejay@mgi1.com" style="color: blue; text-decoration: underline; ">ejay@mgi1.com</a>>; "<a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a>" <<a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a>>; "<a href="mailto:openid-connect-interop@googlegroups.com" style="color: blue; text-decoration: underline; ">openid-connect-interop@googlegroups.com</a>" <<a href="mailto:openid-connect-interop@googlegroups.com" style="color: blue; text-decoration: underline; ">openid-connect-interop@googlegroups.com</a>><br><b>Sent:</b><span class="Apple-converted-space"> </span>Thu, July 26, 2012 1:46:41 PM<br><b>Subject:</b><span class="Apple-converted-space"> </span>RE: [Openid-specs-ab] Mandatory JWK Support for OpenID Connect</span><o:p></o:p></p><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; color: rgb(31, 73, 125); ">Can you provide the rationale or a pointer to the rationale?</span><o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; ">From:</span></b><span style="font-size: 10pt; "><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab-bounces@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span><a href="mailto:[mailto:openid-specs-ab-bounces@lists.openid.net]" style="color: blue; text-decoration: underline; ">[mailto:openid-specs-ab-bounces@lists.openid.net]</a><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Edmund Jay<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 26, 2012 11:58 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">openid-specs-ab@lists.openid.net</a>;<span class="Apple-converted-space"> </span><a href="mailto:openid-connect-interop@googlegroups.com" style="color: blue; text-decoration: underline; ">openid-connect-interop@googlegroups.com</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Openid-specs-ab] Mandatory JWK Support for OpenID Connect</span><o:p></o:p></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> <o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 10pt; color: black; ">This is to inform everyone that the Working Group has decided to make JWK support mandatory for both the client and server.<br>Feedbacks welcome.<br><br><br>-- Edmund</span><o:p></o:p></div></div></div></div></div></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></span></blockquote></div><br></div></body></html>