<html><head><base href="x-msg://1143/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Nat's email was about audience restricting the response from the user-info endpoint, not the request.<div><br></div><div>So different issues.</div><div><br></div><div>The issue below is how to stop the client from sending the bearer token to a counterfeit resource server.</div><div>Access token Phishing.</div><div><br></div><div>I thing the explanation below is a bit rubbish.</div><div><br></div><div>This is not a typical use of audience. Normally only the end recipient of a token validates that it is the intended recipient.</div><div><br></div><div>I think Mike is suggesting that an intermediary looks inside the token to determine who the valid recipients are before it sends it.</div><div><br></div><div>This would be a useful feature (A bit WS-Security), but would only be useful where the access tokens are JWT, WS-Security or SAML.</div><div><br></div><div>I expect that some basic processing rules about who you send access tokens to would be a more general solution.</div><div><br></div><div>The gets the resource server endpoint during discovery and associated that with the access token in some sort of table. </div><div><br></div><div>Where there are additional scopes and endpoints bound to the token that gets more complicated. </div><div>A good argument for getting the aditional tokens via the distributed claims mechanism.</div><div><br></div><div>John<br><div><div>On 2011-11-10, at 11:36 PM, Mike Jones wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Section 4.6.4 of the<span class="Apple-converted-space"> </span><a href="http://tools.ietf.org/html/draft-lodderstedt-oauth-security-01" style="color: blue; text-decoration: underline; ">OAuth Threat Model and Security Considerations</a><span class="Apple-converted-space"> </span>document contains the following. The highlighting is mine:<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><a name="section-4.6.4"><b><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; ">4.6.4</span></b></a><b><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; ">. Threat: Access token phishing by counterfeit resource server<o:p></o:p></span></b></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> An attacker may pretend to be a particular resource server and to<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> accept tokens from a particular authorization server. If the client<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> sends a valid access tokens to this counterfeit resource server, the<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> server in turn may use that token to access other services on behalf<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> of the resource owner.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> Countermeasures:<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> o <span class="Apple-converted-space"> </span><span style="background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: yellow; background-position: initial initial; background-repeat: initial initial; ">Associate the endpoint address of the resource server the client<o:p></o:p></span></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: yellow; background-position: initial initial; background-repeat: initial initial; "> talked to with the access token (e.g. in an audience field) and<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: yellow; background-position: initial initial; background-repeat: initial initial; "> validate association at legitimate resource server.</span><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> The endpoint<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> address validation policy may be strict (exact match) or more<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> relaxed (e.g. same host). This would require to tell the<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> authorization server the resource server endpoint address in the<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "> authorization process.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; page-break-before: always; "><span lang="EN" style="font-size: 10pt; font-family: 'Courier New'; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I believe we need to follow this recommendation and require an audience in the access token on at least a SHOULD basis, per the decision on the working group call today. If anyone disagrees on security grounds, please say why.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> -- Mike<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">P.S. Requiring encryption to restrict the audience seems like SUBSTANTIAL overkill.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a> [mailto:openid-specs-ab-bounces@lists.openid.net]<b>On Behalf Of<span class="Apple-converted-space"> </span></b>John Bradley<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, November 10, 2011 6:58 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Nat Sakimura<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-ab] Audience restriction of access_token/resource ep response in OpenID Connect<o:p></o:p></span></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">With asymmetric keys putting it in the access token works. This is a bit like holder of key confirmation without the TLS.<o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">There are a bunch of security issues with symmetric keys. <o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">The protected resource has to be closely related to the authorization server, as it can masquerade as the <o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Authorization server or the client with the shared secret. <o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">You may also need to encrypt the token to the protected resource, otherwise it too could leak and you pare back to square one.<o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">John B.<o:p></o:p></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">On 2011-11-10, at 8:04 PM, Nat Sakimura wrote:<o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br><br><o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span class="apple-style-span"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; ">Hi. </span></span><o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">Currently, as it turns out in OpenID Connect, the way to audience restrict <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">the response of a resource endpoint is to encrypt the response <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">using the key of the intended client. The server has to keep track of <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">to whom the access_token was issued, i.e., client audience restriction, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">and use the registration information of that client to find out the relevant key. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">By doing so, even if the request comes from a rogue party who phished the <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">legitimate client, the rogue party cannot read the response, so it is secure. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As to the resource endpoint audience restriction is concerned, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is done implicitly in the sense that as the access_token is opaque, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">only the intended endpoint can actually interprete and validate it. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">This is how the resource endpoint audience restriction is done <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in OAuth 2.0 as I understand. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As it is written right now, how to record both client and resource endpoint <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">audience restriction is an implementation detail. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I think it should remain implementation detail, but <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is worthwhile to note that somehow the audience restriction MUST be done. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I am ok with RECOMMENDing that these audience to be encoded <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in the access_token itself, but would like to let the implementors have <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">choices on it. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">--<span class="Apple-converted-space"> </span><br>Nat Sakimura (=nat)<o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank" style="color: blue; text-decoration: underline; ">http://nat.sakimura.org/</a><br>@_nat_en<o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></div></div><p class="MsoNormal" style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "></p></div></div></div></span></blockquote></div><br></div></body></html>