<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Hi Mike,</div><div><br></div><div>RFC 6749 requires TLS on the client's redirect URI in cases where OAuth is used for identity providing.</div><div><br></div><div>"<span style="background-color: rgba(255, 255, 255, 0);">Therefore, if the client relies on</span></div><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; page-break-before: always;"><font face="UICTFontTextStyleBody"><span style="white-space: normal; background-color: rgba(255, 255, 255, 0);"> the authorization code for its own resource owner authentication, the
client redirection endpoint MUST require the use of TLS."</span></font></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; page-break-before: always;"><font face="UICTFontTextStyleBody"><span style="white-space: normal; background-color: rgba(255, 255, 255, 0);"><br></span></font></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; page-break-before: always;"><font face="UICTFontTextStyleBody"><span style="white-space: normal; background-color: rgba(255, 255, 255, 0);">kind regards,</span></font></pre><pre class="newpage" style="margin-top: 0px; margin-bottom: 0px; page-break-before: always;"><font face="UICTFontTextStyleBody"><span style="white-space: normal; background-color: rgba(255, 255, 255, 0);">Torsten.</span></font></pre><div><br><br></div><div><br>Am 11.02.2015 um 03:50 schrieb Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>>:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nat, I agree that those tests should be made optional for Basic. The signature tests are still required for Implicit and Hybrid.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">As for mandating TLS, we’re mandating that the OP endpoints always use TLS. However for the code flow, the RP endpoint is allowed to not use TLS (provided
the OP allows this, which it isn’t required to do).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Roland – I synced your RPtest spreadsheet with the RP tab in the Conformance Tests spreadsheet a while back.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Openid-specs-ab [<a href="mailto:openid-specs-ab-bounces@lists.openid.net">mailto:openid-specs-ab-bounces@lists.openid.net</a>]
<b>On Behalf Of </b>Nat Sakimura<br>
<b>Sent:</b> Monday, February 09, 2015 7:09 PM<br>
<b>To:</b> <a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br>
<b>Subject:</b> [Openid-specs-ab] RP Test<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I suppose we should either drop or relax the following. They are not required in Basic. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">rp-idt-kid-absent<br>
rp-idt-kid<o:p></o:p></p>
</div>
<p class="MsoNormal">rp-alg-rs256<br>
rp-alg-none<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also, I am wondering if the following is accurately reflecting the standard. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">"Uses https for all endpoints unless only using code flow" </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">(It has no identifier assigned to it.)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 3.1.2 states: </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the Authorization Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 3.1.3 states: </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the Token Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black">Section 5.3 states: </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Communication with the UserInfo Endpoint MUST utilize TLS. See </span><span style="font-size:13.0pt;font-family:"Calibri","sans-serif";color:black"><a href="http://openid.net/specs/openid-connect-core-1_0.html#TLSRequirements"><b><span style="font-size:12.0pt;font-family:"Verdana","sans-serif";color:#663333;text-decoration:none">Section 16.17</span></b></a></span><span style="font-family:"Verdana","sans-serif";color:black"> for
more information on using TLS.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana","sans-serif";color:black">Looks like we are mandating to use TLS regardless of the flow. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Nat Sakimura (=nat)<o:p></o:p></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Openid-specs-ab mailing list</span><br><span><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a></span><br><span><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></span><br></div></blockquote></body></html>