<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div style="font-family: Calibri,sans-serif; font-size: 11pt;">Microsoft implicit grant and "full" id token sample does a good job of teaching.<br>
<br>
Start with https://yorkporc.wordpress.com/2015/06/17/implicit-grant-and-bearer-authentication/<br>
<br>
In Microsoft windows vs Microsoft web tooling land, there are very different security models at work, for the same standards. Provisioning a windows account after an opened connect handshake makes tokens (id) into modern Kerberos pacs, whereas bearer id tokens
used between js apps in non confidential clients (angular spas) and web endpoints are more webby (without string security model, in common criteria sense).<br>
<br>
Btw, tls channel binding work is very different to merely doing handshakes over https. Channel binding tokens (in id token format, now) protect 3tier and https-connect sensitive flows against trust point (and therefore tryst point discovery) manipulation. Think
of channel binding tokens as military grade tls... (vs webby stuff, based on commodity PC motherboards, tpm, etc)<br>
<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:cal@fbsdata.com">Cal Heldenbrand</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">6/23/2015 11:29 AM</span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:breno@google.com">Breno de Medeiros</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Cc:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:openid-general@lists.openid.net">openid-general@lists.openid.net</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Re: [OpenID] Discovery Endpoint CORS support?</span><br>
<br>
</div>
<div>
<div dir="ltr">What is a full ID token?<br>
<div class="x_gmail_extra"><br clear="all">
<div>
<div class="x_gmail_signature">---------------------------------------------------------------<br>
Cal Heldenbrand<br>
Web Operations at FBS<br>
Creators of <a href="http://flexmls.com" target="_blank">flexmls</a>® and <a href="http://sparkplatform.com" target="_blank">
Spark Platform</a><br>
<a href="mailto:cal@fbsdata.com" target="_blank">cal@fbsdata.com</a></div>
</div>
<br>
<div class="x_gmail_quote">On Tue, Jun 23, 2015 at 1:18 PM, Breno de Medeiros <span dir="ltr">
<<a href="mailto:breno@google.com" target="_blank">breno@google.com</a>></span> wrote:<br>
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">A more important point is that we should have documented the usage of 'full' ID tokens that contain profile info.</div>
<div class="x_gmail_extra">
<div>
<div class="x_h5"><br>
<div class="x_gmail_quote">On Tue, Jun 23, 2015 at 11:10 AM, John Bradley <span dir="ltr">
<<a href="mailto:ve7jtb@ve7jtb.com" target="_blank">ve7jtb@ve7jtb.com</a>></span> wrote:<br>
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div style="word-wrap:break-word">Yes we should have mentioned that in the discovery spec. That and the JWKS file for the keys.
<div><br>
</div>
<div>John B.<br>
<div>
<blockquote type="cite">
<div>
<div>
<div>On Jun 23, 2015, at 2:57 PM, Cal Heldenbrand <<a href="mailto:cal@fbsdata.com" target="_blank">cal@fbsdata.com</a>> wrote:</div>
<br>
</div>
</div>
<div>
<div>
<div>
<div dir="ltr">
<div>Hi everyone,<br>
<br>
</div>
I noticed when reading through the OIDC core spec, <a href="http://openid.net/specs/openid-connect-standard-1_0-21.html#userinfo" target="_blank">
Section 4</a> has a blurb recommending CORS header support: <br>
<br clear="all">
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
The UserInfo Endpoint SHOULD support the use of Cross Origin Resource Sharing (CORS) [CORS] and or other methods as appropriate to enable Java Script Clients to access the endpoint.<a name="x_14e21a4bc6863ab0_14e219d3c32a3f57_UserInfoRequest"></a></blockquote>
<div>
<div>
<div>
<div><br>
</div>
<div>But when I look through the <a href="https://openid.net/specs/openid-connect-discovery-1_0.html" target="_blank">
Discovery document</a>, there are no mentions of CORS support. If an OP advertises the implicit flow in the metadata, shouldn't CORS support be a requirement in the specification? Otherwise a js client will choke on an AJAX discovery request, and the whole
process is busted unless the developer manually specifies the endpoints.<br>
<br>
</div>
<div>I ran into this when testing the Implicit flow against Google's discovery endpoint, and started down the rabbit hole of reading. ;-)<br>
<br>
</div>
<div>Thank you!<br>
<br>
</div>
<div>--Cal<br>
<br>
</div>
<div>---------------------------------------------------------------<br>
Cal Heldenbrand<br>
Web Operations at FBS<br>
Creators of <a href="http://flexmls.com/" target="_blank">flexmls</a>® and <a href="http://sparkplatform.com/" target="_blank">
Spark Platform</a><br>
<a href="mailto:cal@fbsdata.com" target="_blank">cal@fbsdata.com</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@lists.openid.net" target="_blank">general@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-general" target="_blank">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
<br>
_______________________________________________<br>
general mailing list<br>
<a href="mailto:general@lists.openid.net" target="_blank">general@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-general" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
</div>
</div>
<span class="x_HOEnZb"><font color="#888888">-- <br>
<div>--Breno<br>
</div>
</font></span></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>