[Openid-specs-ab] well-known location for sector_identifier_uri

[Manger, James]

The sector_identifier_uri [core §8.1<http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg>, dynamic reg §5<http://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation>] lists the redirect_uris of apps that can receive the same subscriber ids (subs) from OIDC providers that issuer pairwise subs. The list is effectively a domain authorizing the apps that are allowed to be associated with it.

Because it conveys a domain's authority, the sector_identifier_uri should have a fixed /.well-known/ path on the domain.

Otherwise, a domain may unwittingly authorize an app. Any content on a domain that happens to be a URI in square brackets can be misused by using it as a sector_identifier_uri to receive the domain's subs. Any redirect from a domain (not just an open redirector) can be misused by the destination of the redirect to receive the domain's subs.

To address this risk, how about we require sector_identifier_uri to be:
  https://<domain>/.well-known/openid/apps.json

I'm not sure if this extra restriction can be done as a errata (to core & dynamic reg), or something more substantial is necessary.

--
James Manger
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20160313/be38a714/attachment.html>