<div dir="ltr">Thorsen was quite clear that he wanted (and implemented) account access without proximate use consent.<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Peace ..tom</div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr">On Thu, Nov 15, 2018 at 11:06 PM n-sakimura via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-1557960723656001102WordSection1">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Hmm. At least, in UK OB, RO consent is required for the data access and fund transfer.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">In the ROPC model that some organization in the continental Europe is promoting, you might be right.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Nat<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><b>From:</b> Openid-specs-ab <<a href="mailto:openid-specs-ab-bounces@lists.openid.net" target="_blank">openid-specs-ab-bounces@lists.openid.net</a>>
<b>On Behalf Of </b>Tom Jones via Openid-specs-ab<br>
<b>Sent:</b> Tuesday, November 06, 2018 7:03 AM<br>
<b>To:</b> <a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a><br>
<b>Cc:</b> Tom Jones <<a href="mailto:thomasclinganjones@gmail.com" target="_blank">thomasclinganjones@gmail.com</a>>; Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Subject:</b> Re: [Openid-specs-ab] Idea: client issue token themselves<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">right, what bugs me about the UKOB & PSD2 is that the user (resource owner) consent is not even required.<u></u><u></u></p>
<div>
<p class="MsoNormal">That is a major reason why i recommended that openid not approve the FAPI specs.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">allowing the OP to approve client access to my money is no way in my interest.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Peace ..tom<u></u><u></u></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Nov 5, 2018 at 1:19 PM Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">Hi Tom!<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Thanks for your thoughts.<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">The AS still authenticates the client and verifies the requested scopes as it does today. It also authenticates the resource_owner who authorizes the client access to resources
(which is not really obvious in the diagram, I will update that).<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Details about the resource_owner may be included but maybe not. If they, the best way may be as an id_token. That id_token would include values such as ‘acr’.<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">The client is trustworthy if the RS accepts the grant of the AS. And the grant can only be meant for that particular client since only that client can sign the JWT with a ‘cnf.x5t#S256’
matching value.<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">I will collect more feedback and update my page accordingly.<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Thanks,<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Sascha<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-CA" style="font-size:12.0pt;color:black">From:
</span></b><span lang="EN-CA" style="font-size:12.0pt;color:black">Tom Jones <<a href="mailto:thomasclinganjones@gmail.com" target="_blank">thomasclinganjones@gmail.com</a>><br>
<b>Date: </b>Monday, November 5, 2018 at 10:45 AM<br>
<b>To: </b>Artifact Binding/Connect Working Group <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>><br>
<b>Cc: </b>"Preibisch, Sascha H" <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>><br>
<b>Subject: </b>Re: [Openid-specs-ab] Idea: client issue token themselves</span><span lang="EN-CA"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA">There seems to be a fundamental problem with even calling this an "authorization server". Authorization happens only at the resource server itself. The best the
"AS" can do is issue a set of claims (some masquerading as scopes) - some of which it might also verify. The challenge with the jwt is that the validity of the entire jwt is what is asserted. What is needed by the resource server is the validity statement
for each claim. Including the claim that the client is trustworthy and (in openid) that the level of authentication and/or proof-of-presence and/or consent of the user was validated (or not). Combining these various ideas might seem like a good idea, but
if the resource server has different criteria for different claims, it might not be sufficient.<br clear="all">
<u></u><u></u></span></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA">Peace ..tom<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA">On Fri, Nov 2, 2018 at 9:53 AM Preibisch, Sascha H via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net" target="_blank">openid-specs-ab@lists.openid.net</a>>
wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal">Hi all!<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">I would like to share the idea of oauth clients that issue token themselves with you.
<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">I wrote a blog post about it here:<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><a href="https://communities.ca.com/blogs/oauth/2018/11/01/oauth-20-serverless-token-issuance" target="_blank">https://communities.ca.com/blogs/oauth/2018/11/01/oauth-20-serverless-token-issuance</a><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Thanks for any feedback,<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">Sascha<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal">P.S.: today is the last day of CA, as of Monday its Broadcom. I am not sure if my blog post is available afterwards at that location!<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"> <span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">Sascha Preibisch</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">Principal Software Architect</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">CA Technologies</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"> </span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">CA Mobile API Gateway</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">CA API Management OAuth Toolkit</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"> </span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">Email: <a href="mailto:sascha.preibisch@ca.com" target="_blank"><span style="color:#954f72">sascha.preibisch@ca.com</span></a></span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">Blog:
<a href="https://communities.ca.com/blogs/oauth" target="_blank">https://communities.ca.com/blogs/oauth</a></span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-CA" style="font-size:14.0pt">My book</span></b><span lang="EN-CA" style="font-size:14.0pt">:</span><span lang="EN-CA">
</span><b><span lang="EN-CA" style="font-size:14.0pt"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.apress.com_de_book_9781484241394&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=whHzJG0H4_GWBEIB6Aixz-VM4jJp8nIActACrXMDfbw&s=dIgpaNQlJyLtp2AnI65CC2wCZSdArSftwoW0DaVSK_M&e=" target="_blank"><span style="color:#0563c1">API
Development - A Practical Guide for Business Implementation Success</span></a></span></b><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:14.0pt">Latest blog post:
<a href="https://communities.ca.com/blogs/oauth/2018/09/12/azure-ad-integration" target="_blank">
<span style="color:#0563c1">Azure AD integration</span></a></span></b><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:14.0pt">Previous blog post:
<a href="https://communities.ca.com/blogs/oauth/2018/06/25/oauth-toolkit-otk-and-ifttt-tutorial" target="_blank">
<span style="color:#0563c1">OTK + IFTTT tutorial</span></a></span></b><span lang="EN-CA"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-CA">_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dab&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=whHzJG0H4_GWBEIB6Aixz-VM4jJp8nIActACrXMDfbw&s=xMRzrb0tb7djuhR19fKJFgn0Ka84NWsGtIFiy-Wpp_Y&e=" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><u></u><u></u></span></p>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>