[Openid-specs-ab] OpenID Connect and Identity Delegation

Mike Jones Michael.Jones at microsoft.com
Fri Mar 29 00:46:25 UTC 2013


I think we may be largely agreeing in substance but use different words to express the same thing.

In my mind, if the client gives its bearer token to another legitimate piece of code to perform an action for it, then it is logically part of the implementation of the client.  The presenter logically remains the client to whom the token was issued.  It's as if no sharing occurred.

However, when the client explicitly gives a token with azp in it to a different authorized client, which is performing actions for itself and not directly as part of the client to whom the token was issued, that's a different case.  In that case, I can see why "azp" is wanted to identify the second client as an authorized party, since it is acting on its own behalf, and not on behalf of the original client.  (Yes, I understand their actions may be aligned in purpose and coordinated, but that doesn't make them the same OAuth client.)

Also, I'm pretty sure that we can agree that if the token is leaked by either party to an unauthorized party, that it's always a security bug, and not a legitimate use of the token.

                                                                -- Mike

From: Nat Sakimura [mailto:sakimura at gmail.com]
Sent: Thursday, March 28, 2013 5:29 PM
To: Mike Jones
Cc: Tim Bray; openid-specs-ab
Subject: Re: [Openid-specs-ab] OpenID Connect and Identity Delegation

Inline:
2013/3/29 Mike Jones <Michael.Jones at microsoft.com<mailto:Michael.Jones at microsoft.com>>
"azp" isn't an OAuth construct - it's an OpenID Connect construct that we've defined (although apparently not precisely enough that we have broad agreement on what it means and how it's used).  I think the outcome of this thread should be to clarify the definition so others will understand better what was intended and what wasn't.

My logic is that if it was legitimate to just hand off the token from one client to another without any indication that it's OK to do so, we wouldn't need "azp" at all; we'd just give the token to the other presenter and it would happily use it.

That actually is the notion of bearer as generally (i.e., not only in OAuth world) understood. Also, the OAuth specs does not preclude it.

"azp" is there as a declaration that, in this particular case, the handoff was authorized, and that that the party identified in the "azp" claim is a legitimate presenter, even though it was not the requester of the token.  Hence, without "azp", the token is scoped to the requesting client as the sole authorized presenter.

To me, azp is the explicit restriction on who can use the token.
Bearer has no restriction like that. Or, if it does, it should change its name as well as add text about it in the spec.


In summary, if handoff to arbitrary parties was OK, we wouldn't need "azp" in the first place.

As long as the spec text does not preclude it, it is ok, and it seems it is ok from the current text and the naming of it. The security model of the bearer is contingent on how securely you can hold onto the token. In the real world, it is equivalent to how securely you can hold onto your cash, which is a prime example of a bearer instrument. It is also perfectly fine for you to give the cash to your wife to dispense. This does not happen in the case of a credit card, which is not a bearer instrument but a registered instrument with card holder name as "azp".

Nat


                                                                -- Mike

From: Nat Sakimura [mailto:sakimura at gmail.com<mailto:sakimura at gmail.com>]
Sent: Thursday, March 28, 2013 5:06 PM

To: Mike Jones
Cc: Tim Bray; openid-specs-ab
Subject: Re: [Openid-specs-ab] OpenID Connect and Identity Delegation

Could you point me to the text in OAuth spec describing it?

Also, there are legitimate cases where changing hands happens, which is not leaking.
As long as the original party that has gotten the bearer token is consciously handing it to another client, it should be fine. e.g., sometimes connected client handing it to the server component that has a different client_id.

Nat
2013/3/29 Mike Jones <Michael.Jones at microsoft.com<mailto:Michael.Jones at microsoft.com>>
Changing hands doesn't mean that it's authorized.  It just means that the token has been leaked to an unauthorized party.

                                                                -- Mike

From: Nat Sakimura [mailto:sakimura at gmail.com<mailto:sakimura at gmail.com>]
Sent: Thursday, March 28, 2013 4:51 PM
To: Mike Jones
Cc: Tim Bray; openid-specs-ab

Subject: Re: [Openid-specs-ab] OpenID Connect and Identity Delegation

Which is not the case that it may sometime change the hand. The name bearer suggests otherwise as well. Bearer is whoever has it.

>From Oxford Dictionary:

1a person or thing that carries or holds something:
2a person who presents a cheque or other order to pay money:

And here is a description of "bearer bond" from wikipedia:

A bearer bond is a debt security issued by a business entity, such as a corporation, or by a government. It differs from the more common types of investment securities in that it is unregistered - no records are kept of the owner, or the transactions involving ownership. Whoever physically holds the paper on which the bond is issued owns the instrument<http://en.wikipedia.org/wiki/Financial_instrument>. This is useful for investors<http://en.wikipedia.org/wiki/Investor> who wish to retain anonymity. Recovery of the value of a bearer bond in the event of its loss, theft, or destruction is usually impossible.

At the same time, bearer is more privacy preserving in some sense. In a "registered token", i.e., token with the "azp", it is impossible to hide who is presenting it.

Nat

--
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en



--
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-ab/attachments/20130329/2e540e24/attachment-0001.html>


More information about the Openid-specs-ab mailing list