[Openid-specs-mobile-profile] Return the token immediately in CIBA request

[charles.marais at orange.com]

Hello Gonzalo,

My opinion about this :

It is somehow close to the proposition we had made based on JWT 
Assertion (for a GSMA thread).

I don't see any blocking point except one important thing : in this 
context, there is no user authentication, so the id_token which 
materializes the result of the user authentication (assertion of 
authentication) must not be present aside the access_token.

Br,
Charles.



Le 23/04/2018 à 11:58, GONZALO FERNANDEZ RODRIGUEZ a écrit :
>
> Hi guys,
>
> Some of my colleagues say that it would be great to add an additional 
> amend to the “push notification” mechanism of the CIBA spec to allow 
> it to return the response with the tokens directly in case of there is 
> no need to interact with the user. I am referring to those cases where 
> the OID provider generates an access_token tied to the user but there 
> is no need to interact with the user because the permission has 
> already grabbed by the Service Provider, it should be something like a 
> client_credentials but binding the access_token to an specific user.
>
> The idea should be to return immediately the response with the tokens, 
> of course the Service Provider would authenticate the token using 
> mutual TLS or private_key_jwt, that way a roundtrip request would be 
> saved and it would perform better in these specific cases.
>
> Do you want there would be any security problem or other kind of problem?
>
> Best,
>
> Gonza.
>
>
> ------------------------------------------------------------------------
>
> Este mensaje y sus adjuntos se dirigen exclusivamente a su 
> destinatario, puede contener información privilegiada o confidencial y 
> es para uso exclusivo de la persona o entidad de destino. Si no es 
> usted. el destinatario indicado, queda notificado de que la lectura, 
> utilización, divulgación y/o copia sin autorización puede estar 
> prohibida en virtud de la legislación vigente. Si ha recibido este 
> mensaje por error, le rogamos que nos lo comunique inmediatamente por 
> esta misma vía y proceda a su destrucción.
>
> The information contained in this transmission is privileged and 
> confidential information intended only for the use of the individual 
> or entity named above. If the reader of this message is not the 
> intended recipient, you are hereby notified that any dissemination, 
> distribution or copying of this communication is strictly prohibited. 
> If you have received this transmission in error, do not read it. 
> Please immediately reply to the sender that you have received this 
> communication in error and then delete it.
>
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu 
> destinatário, pode conter informação privilegiada ou confidencial e é 
> para uso exclusivo da pessoa ou entidade de destino. Se não é vossa 
> senhoria o destinatário indicado, fica notificado de que a leitura, 
> utilização, divulgação e/ou cópia sem autorização pode estar proibida 
> em virtude da legislação vigente. Se recebeu esta mensagem por erro, 
> rogamos-lhe que nos o comunique imediatamente por esta mesma via e 
> proceda a sua destruição
>
>
> _______________________________________________
> Openid-specs-mobile-profile mailing list
> Openid-specs-mobile-profile at lists.openid.net
> http://lists.openid.net/mailman/listinfo/openid-specs-mobile-profile

-- 

*MARAIS Charles *
*Orange Labs Lannion*
Tel : +33 (0)2 96 07 24 18
charles.marais at orange.com <mailto:charles.marais at orange.com>
Orange Labs Lannion
2, avenue Pierre Marzin
22307 LANNION Cedex - France



_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-mobile-profile/attachments/20180424/6c960605/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: orange_logo.gif
Type: image/gif
Size: 1264 bytes
Desc: not available
URL: <http://lists.openid.net/pipermail/openid-specs-mobile-profile/attachments/20180424/6c960605/attachment.gif>