<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>+1</div><div><br></div><div>I wonder how these SAML implementations are dealing with CSRF. <br><br>=nat via iPhone</div><div><br>Nov 26, 2013 3:03、"Richer, Justin P." <<a href="mailto:jricher@mitre.org">jricher@mitre.org</a>> のメッセージ:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
I really don't like this. It goes against the structure of how OAuth works, and there's no way for the RP to put anything into the id token (like nonce, state, etc.) to bind to a particular session and prevent a stolen id token being used to log in directly
by another user. The fact that the RP starts the auth conversation is important, and I'm not at all comfortable with having this workaround.
<div><br>
</div>
<div>At the very least, this should be proposed as an extension and get hammered out separately. (But even then I don't think it has legs.)<br>
<div><br>
</div>
<div> -- Justin</div>
<div><br>
<div>
<div>On Nov 25, 2013, at 10:58 AM, John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>For Core Section 3 I would like to add the following optional parameter to the login initiation endpoint.</div>
<div><br>
</div>
<dt style="margin-top: 0.5em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
id_token</dt><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
OPTIONAL. If the initiator is the iss then it may include an initial id_token. The value of exp SHOULD be set to a small value in the range of 5 minutes. </dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
The id_token must contain a valid aud restricting it to the client receiving it.</dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
If the client receives a value for this string-valued parameter, it MUST include it in the subsequent authorization request as the id_token<samp>_hint</samp> parameter value.</dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
<br>
</dd><dd style="margin-right: 2em; font-family: verdana, helvetica, arial, sans-serif; font-size: 13px;">
<br>
<div>I have been getting push back from people looking to convert from SAML that Connect forces many more round trips than SAML for doing IdP initiated login. </div>
<div>Sending an initial short lived id_token lets the client do the quick customization of the UI that the id_token was intended to enable while allowing the client to get access tokens and a new id_token in the background using prompt=none. </div>
<div><br>
</div>
<div>This also reduces the eventual pressure to add more parameters to the endpoint as the AS can tack on additional claims it needs to maintain state.</div>
<div><br>
</div>
<div>I think we did have the id_token as a parameter at wine point then changed it to the login_hint when that was added to make it more general.</div>
<div><br>
</div>
<div>I know this is a late addition request.</div>
<div><br>
</div>
<div>John B.</div>
</dd></div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br><span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></body></html>