<div dir="ltr">OK. That's probably why I did not find any issue with it :-)</div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/10/22 Mike Jones <span dir="ltr"><<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The text on using refresh tokens in section 11 is not new. The section headings are. That being said, more review of any section is always welcomed!<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Nat Sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>]
<br>
<b>Sent:</b> Monday, October 21, 2013 10:23 AM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> Re: [Openid-specs-ab] New Core: 2.3.3.8 RECOMMENDs the same Access Token but...<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2.3.3.6 seems fine to me. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The section 11. is also new. We need to read them carefully. <u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2013/10/22 Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">This, and the related text about the multiple ID Tokens possible with the hybrid flow are on the
agenda to discuss today.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">The text about the ID Token in
<a href="http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken2" target="_blank">
http://openid.net/specs/openid-connect-core-1_0.html#HybridIDToken2</a> is more important, actually, containing minimum requirements that the issuer and subject be the same, etc.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> -- Mike</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a> [mailto:<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Nat Sakimura<br>
<b>Sent:</b> Monday, October 21, 2013 9:38 AM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] New Core: 2.3.3.8 RECOMMENDs the same Access Token but...</span><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">The new core recommends the following. This seems to be a new text introduced in the new core. <u></u><u></u></p>
</div>
<h3><span lang="EN">2.3.3.8. Access Token</span><u></u><u></u></h3>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif"">If an Access Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case with
the </span><tt><span lang="EN" style="font-size:10.0pt">response_type</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif""> values
</span><tt><span lang="EN" style="font-size:10.0pt">code token</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif""> and
</span><tt><span lang="EN" style="font-size:10.0pt">code id_token token</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif"">, it is RECOMMENDED that their values be the same.</span><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Is this true? I feel like the opposite is true. The reason for getting Access Token from both the AuthZ Endpoint and the Token Endpoint is that they have different security characteristics:
The later is more secure and thus trusted. So, there is a value in differentiating between them. e.g. the former has lesser expiry time as well as lesser permission. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I feel like it should be as follows: <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<h3><span lang="EN">2.3.3.8. Access Token</span><u></u><u></u></h3>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif"">If an Access Token is returned from both the Authorization Endpoint and from the Token Endpoint, which is the case with
the </span><tt><span lang="EN" style="font-size:10.0pt">response_type</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif""> values </span><tt><span lang="EN" style="font-size:10.0pt">code token</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif""> and </span><tt><span lang="EN" style="font-size:10.0pt">code id_token token</span></tt><span lang="EN" style="font-family:"Verdana","sans-serif"">,
it is RECOMMENDED that their values be different. The access token returned from Authorization Endpoint is more vulnerable to various attack so that it has less trust than that returned from the Token Endpoint. Thus, the Server MAY give lesser permission and
shorter life time for the Access Token that is returned from the Authorization Endpoint. </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif"">Section 2.3 has bunch of bugs which was quite clear in how to fix, but this one was not that obvious so I am asking. </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN" style="font-family:"Verdana","sans-serif"">Best, </span><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal">--
<br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <br>
Nat Sakimura (=nat)<u></u><u></u></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<u></u><u></u></p>
</div>
</div>
</div></div></div>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Nat Sakimura (=nat)<div>Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>@_nat_en</div>
</div>