<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">That might be possible but at the moment no one is using a registration access token.<div class=""><br class=""></div><div class="">That has been more or less replaced by the software statement. </div><div class=""><br class=""></div><div class="">However in CIBA polling you have no way to bind the software statement to the client. </div><div class="">To do that you need to treat the software statement as secret.</div><div class=""><br class=""></div><div class="">We would also need to look at what happens when the client updates the software statement to say add a new redirect URI. </div><div class=""><br class=""></div><div class="">What is the relationship between new and old so that the same siu can be specified?</div><div class=""><br class=""></div><div class="">For the GSMA it might be possible to say that the software statement must always include a SIU. </div><div class="">Then we punt to some unspecified system to correlate registrations.</div><div class=""><br class=""></div><div class="">I don’t know how that would work in a generic spec?</div><div class=""><br class=""></div><div class="">Something like don’t allow CIBA polling unless the registration is done via a software statement from a federation operator that is verifying the SIU via some out of band mechanism.</div><div class=""><br class=""></div><div class="">That however doesn't get around the problem that we now have a bearer software statement that could be used by anyone.</div><div class=""><br class=""></div><div class="">John B.</div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jun 19, 2017, at 5:25 AM, <a href="mailto:Axel.Nennker@telekom.de" class="">Axel.Nennker@telekom.de</a> wrote:</div></blockquote><blockquote type="cite" class=""><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Maybe we could define that the client who first used a sector_identifer_uri can use its Registration Access Token to register the next client that wants join the group of clients that use this SIU?<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Axel<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><a href="https://openid.net/specs/openid-connect-registration-1_0.html#Terminology" style="color: purple; text-decoration: underline;" class="">https://openid.net/specs/openid-connect-registration-1_0.html#Terminology</a><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>John Bradley [<a href="mailto:ve7jtb@ve7jtb.com" class="">mailto:ve7jtb@ve7jtb.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Mittwoch, 14. Juni 2017 21:57<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Nennker, Axel <<a href="mailto:Axel.Nennker@telekom.de" class="">Axel.Nennker@telekom.de</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:James.H.Manger@team.telstra.com" class="">James.H.Manger@team.telstra.com</a>; <a href="mailto:openid-specs-mobile-profile@lists.openid.net" class="">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-mobile-profile] Issue 52 CIBA Pairwise Identifiers Structuring Text<o:p class=""></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">inline.<o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Jun 14, 2017, at 2:16 PM, <<a href="mailto:Axel.Nennker@telekom.de" style="color: purple; text-decoration: underline;" class="">Axel.Nennker@telekom.de</a>> <<a href="mailto:Axel.Nennker@telekom.de" style="color: purple; text-decoration: underline;" class="">Axel.Nennker@telekom.de</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Maybe the point we are talking past each other is that in front channel ONE client_id can have several redirect_uris which lead to different subs when NO sector_identifier_uri is defined while in back channel there are no redirect_uris and there is always a sector_identifier_uri?</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Also two different clients can have the same SIU and generate the same PPID with different redirect URI, so as an example<span class="Apple-converted-space"> </span><a href="http://google.com/" style="color: purple; text-decoration: underline;" class="">Google.com</a><span class="Apple-converted-space"> </span>and<span class="Apple-converted-space"> </span><a href="http://youtube.com/" style="color: purple; text-decoration: underline;" class="">Youtube.com</a><span class="Apple-converted-space"> </span>could cave diffrent landing pages for redirect but generate the same PPID. This is perhaps the main reason we added this, otherwise we could have used the client_id directly to generate the PPID.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Perhaps you are thinking PPID are always different for different client_id. They are not. You could cave one client_id for CIBA and another for front channel and have both generate the same PPID via the SIU.<br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">So in OIDC (front channel) one legal entity can have one backend server and several mobile apps and in the redirect all apps use the same client_id but different redirect_uris which leads to different subs if no siu is defined and to the same sub if a siu is defined.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Although I wonder why one legal entity might want different subs anyway…</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">They wouldn't that is why they would use the SIU perhaps it should have been mediatory in the base spec, but wasn't because it was argued that most clients have only one redirect_uri. What IdP so to create a PPID without a sector identifier is unspecified and many may use the client_id causing a problem if the client_id is ever changed, or use the first registered redirect_uri (that can also cause things to break or be insecure)<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">At the time people didn’t think IdP would really use PPID so people were not that interested.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I can buy the argument that the core spec made a mistake not requiring a SIU if PPID are used.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">And in OIDC one legal entity which has multiple clients with different client_ids would define a sector_identifier_uri to get the same sub for all clients.</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Yes.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">In CIBA the same legal entity with multiple client_ids needs to define a siu to get the same sub or different sius (one for each client_id) if they want different subs.</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Yes but they need to do it in a way that some other organization can’t register there SIU and be able to correlate identifiers without permission.<br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Although none of this has anything to do with validation of meta-data nor with jwks_uris…</span><o:p class=""></o:p></div></div></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The prevention of SIU hijacking is done in registration section 5<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Adding the jwks_uri is one suggestion of a way to prevent SIU hijacking. <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The question is how can the AS correlate across multiple client_id.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Another possibility would be to make the client authenticate for registration in some way, <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Perhaps the client creates a self signed software statement that contains the jwks_uri to validate the software_statement, and contains the SIU that also contains the jwks_uri. That would prove the client registering is part of the same admin domain. The client can then get a client_secret and client_id and use those at the authorization and token endpoints.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I am open to other ideas, but something needs to securely correlate multiple clients using the same SIU and without a redirect or post back URI to check we need something else.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">John B.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">//Axel</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Openid-specs-mobile-profile [<a href="mailto:openid-specs-mobile-profile-bounces@lists.openid.net" style="color: purple; text-decoration: underline;" class="">mailto:openid-specs-mobile-profile-bounces@lists.openid.net</a>]<span class="apple-converted-space"> </span><b class="">On Behalf Of<span class="apple-converted-space"> </span></b>Nennker, Axel<br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Mittwoch, 14. Juni 2017 09:52<br class=""><b class="">To:</b><span class="apple-converted-space"> </span><a href="mailto:James.H.Manger@team.telstra.com" style="color: purple; text-decoration: underline;" class="">James.H.Manger@team.telstra.com</a>;<span class="Apple-converted-space"> </span><a href="mailto:ve7jtb@ve7jtb.com" style="color: purple; text-decoration: underline;" class="">ve7jtb@ve7jtb.com</a><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span><a href="mailto:openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline;" class="">openid-specs-mobile-profile@lists.openid.net</a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>Re: [Openid-specs-mobile-profile] Issue 52 CIBA Pairwise Identifiers Structuring Text</span><o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">inline</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm;" class=""><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Manger, James [</span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="mailto:James.H.Manger@team.telstra.com" style="color: purple; text-decoration: underline;" class=""><span lang="DE" style="color: purple;" class="">mailto:James.H.Manger@team.telstra.com</span></a></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">]<span class="apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Mittwoch, 14.<span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Juni 2017 06:29<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>Nennker, Axel <<a href="mailto:Axel.Nennker@telekom.de" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">Axel.Nennker@telekom.de</span></a>>;<span class="apple-converted-space"> </span><a href="mailto:ve7jtb@ve7jtb.com" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">ve7jtb@ve7jtb.com</span></a><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span><a href="mailto:openid-specs-mobile-profile@lists.openid.net" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">openid-specs-mobile-profile@lists.openid.net</span></a><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>RE: [Openid-specs-mobile-profile] Issue 52 CIBA Pairwise Identifiers Structuring Text</span><o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Axel,</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">> What are the threats if all client metadata is validated at registration time and all CIBA requests are authenticated?</span><o:p class=""></o:p></div></div><div style="margin-left: 53.4pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -18pt;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">-</span><span lang="EN-US" style="font-size: 7pt; color: rgb(31, 73, 125);" class=""> <span class="apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">BadClient is not able to register for the same sector_identifier_uri as GoodPollingClient (regardless of CIBA or OIDC) This is nothing bad introduced by CIBA.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">This is your mistake.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Multiple clients can register the same sector_identifier_uri — that is the whole point of the sector_id concept (grouping multiple apps). The issue is how does the registration system distinguish BadClient from OtherGoodPollingClient when both register the same sector_id?</span><o:p class=""></o:p></div></div><div style="margin-left: 35.4pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I understand that point. That is the whole purpose of sector_identifier_uri.</span><o:p class=""></o:p></div></div><div style="margin-left: 35.4pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The current Discovery spec does not go into details on validation.</span><o:p class=""></o:p></div></div><div style="margin-left: 35.4pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The OIDC spec, too, does not go into detail how the validation is done.</span><o:p class=""></o:p></div></div><div style="margin-left: 35.4pt;" class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">There is nothing that is CIBA specific about validation.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">--</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span lang="EN-AU" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">James Manger</span></div></div></div></blockquote></div></div></div></div></blockquote></div><br class=""></div></body></html>