<div dir="ltr"><div>I added some comments about the JAR/PAR use to <a href="https://bitbucket.org/openid/connect/issues/1164/insecure-front-channel-use-of">https://bitbucket.org/openid/connect/issues/1164/insecure-front-channel-use-of</a> but not sure that's the best or most appropriate palce. So copied below too:<br></div><div><li class="gmail-issue-comment gmail-comment" id="gmail-comment-58105483"><div class="gmail-wiki-content gmail-comment-content">
<p>draft -12 <a href="https://openid.net/specs/openid-connect-federation-1_0-12.html#rfc.section.9.1.1.1" rel="nofollow">https://openid.net/specs/openid-connect-federation-1_0-12.html#rfc.section.9.1.1.1</a>
is now using the request object as one option. However, it requires
‘sub’ saying “The claim sub MUST contain the entity ID of the OpenID
Connect provider.” I assume that’s a mistake and should have said it’s the client identifier? That’d make more sense and is what the
content of the example has. The same presumably erroneous text is there
for ‘iss’ too.</p>
<p>But <em>WHY</em> is sub required? The same data would already be
carried in the ‘iss’ claim and the ‘client_id’ claim and the
‘client_id’ parameter. Worse the ‘sub’ claim means that the request JWT
could likely be used as a private_key_jwt in a token confusion type
attack as discussed in <a href="https://github.com/oauthstuff/draft-oauth-par/issues/41#issuecomment-615475230" rel="nofollow">https://github.com/oauthstuff/draft-oauth-par/issues/41#issuecomment-615475230</a> and subsequent comments. So the problem at the heart of this issue is still present. </p>
</div></li><li class="gmail-issue-comment gmail-comment" id="gmail-comment-58105483"><br></li><li class="gmail-issue-comment gmail-comment" id="gmail-comment-58105707"><div class="gmail-wiki-content gmail-comment-content">
<p>Also -12 references an old and expired PAR draft <a href="https://openid.net/specs/openid-connect-federation-1_0-12.html#PAR" rel="nofollow">https://openid.net/specs/openid-connect-federation-1_0-12.html#PAR</a> and <a href="https://openid.net/specs/openid-connect-federation-1_0-12.html#rfc.section.3.2" rel="nofollow">https://openid.net/specs/openid-connect-federation-1_0-12.html#rfc.section.3.2</a>
has “URL of the Authorization Server's Authorization Endpoint or the
Authorization Server's entity_id” (note ‘entity_id’ isn’t used anywhere
else) for the ‘aud’ of private_key_jwt, which isn’t consistent with the
below text from <a href="https://www.ietf.org/id/draft-ietf-oauth-par-01.html#section-2" rel="nofollow">https://www.ietf.org/id/draft-ietf-oauth-par-01.html#section-2</a> :</p>
<p>“Note that there's some potential ambiguity around the appropriate
audience value to use when JWT client assertion based authentication is
employed. To address that ambiguity the issuer identifier URL of the AS
according to [<a href="https://www.ietf.org/id/draft-ietf-oauth-par-01.html#RFC8414" rel="nofollow">RFC8414</a>]
SHOULD be used as the value of the audience. In order to facilitate
interoperability the AS MUST accept its issuer identifier, token
endpoint URL, or pushed authorization request endpoint URL as values
that identify it as an intended audience.“</p></div></li></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jul 1, 2020 at 7:22 PM Mike Jones via Openid-specs-ab <<a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_5216258377845328471WordSection1">
<p class="MsoNormal">See <a href="https://openid.net/2020/07/01/openid-connect-federation-draft-incorporating-feedback-from-first-interop-event/" target="_blank">
https://openid.net/2020/07/01/openid-connect-federation-draft-incorporating-feedback-from-first-interop-event/</a>. This now uses JAR or PAR for automatic registrations.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> -- Mike<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><br>
</blockquote></div>
<br>
<i style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:rgb(255,255,255);font-family:proxima-nova-zendesk,system-ui,-apple-system,system-ui,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;color:rgb(85,85,85)"><span style="margin:0px;padding:0px;border:0px;outline:0px;vertical-align:baseline;background:transparent;font-family:proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",Arial,sans-serif;font-weight:600"><font size="2">CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</font></span></i>