<html><head><base href="x-msg://1347/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">From what I understand of Mike's proposal.<div><br></div><div>He is proposing that the client also use information in the access token to determine what resources it can send the token to.</div><div><br></div><div>This is a separate issue from the protected resource determining if it is the intended audience of the token.</div><div><br></div><div>Perhaps we can discuss it on today's call.</div><div><br></div><div>John</div><div><div><div>
}On 2011-11-14, at 4:06 AM, Anthony Nadalin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">></span><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><span class="Apple-converted-space"> </span>I am ok with RECOMMENDing that these audience to be encoded in the access_token itself, but would like to let the implementors have choices on it<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">Not sure what you mean by encoded in the access_token, I assume you mean that there is a aud_restriction claim in the token, not that the token is encoded somehow that the receiving parties can decode?</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab-bounces@lists.openid.net">openid-specs-ab-bounces@lists.openid.net</a> [mailto:openid-specs-ab-bounces@lists.openid.net]<b>On Behalf Of<span class="Apple-converted-space"> </span></b>Nat Sakimura<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, November 10, 2011 5:04 PM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-ab@lists.openid.net">openid-specs-ab@lists.openid.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Openid-specs-ab] Audience restriction of access_token/resource ep response in OpenID Connect<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span class="apple-style-span"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; ">Hi. </span></span><o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">Currently, as it turns out in OpenID Connect, the way to audience restrict <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">the response of a resource endpoint is to encrypt the response <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">using the key of the intended client. The server has to keep track of <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">to whom the access_token was issued, i.e., client audience restriction, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">and use the registration information of that client to find out the relevant key. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">By doing so, even if the request comes from a rogue party who phished the <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">legitimate client, the rogue party cannot read the response, so it is secure. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As to the resource endpoint audience restriction is concerned, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is done implicitly in the sense that as the access_token is opaque, <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">only the intended endpoint can actually interprete and validate it. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">This is how the resource endpoint audience restriction is done <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in OAuth 2.0 as I understand. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); "><o:p> </o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">As it is written right now, how to record both client and resource endpoint <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">audience restriction is an implementation detail. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I think it should remain implementation detail, but <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">it is worthwhile to note that somehow the audience restriction MUST be done. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">I am ok with RECOMMENDing that these audience to be encoded <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">in the access_token itself, but would like to let the implementors have <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; "><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(34, 34, 34); ">choices on it. <o:p></o:p></span></div></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">--<span class="Apple-converted-space"> </span><br>Nat Sakimura (=nat)<o:p></o:p></div><div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Chairman, OpenID Foundation<br><a href="http://nat.sakimura.org/" target="_blank" style="color: blue; text-decoration: underline; ">http://nat.sakimura.org/</a><br>@_nat_en<o:p></o:p></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a><br>http://lists.openid.net/mailman/listinfo/openid-specs-ab</div></span></blockquote></div><br></div></body></html>