<html><head><base href="x-msg://6187/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Yes we wound up using the Oauth names rather than the JWT names. We should make that change.<div><br></div><div><br><div><div>On 2012-05-18, at 1:50 AM, Mike Jones wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); ">For what it’s worth, I’ve received similar feedback from other parties. We should probably consider changing the description of the request object from being a JWT to being a JWS signed JSON object.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); "> -- Mike<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:jose-bounces@ietf.org" style="color: blue; text-decoration: underline; ">jose-bounces@ietf.org</a><span class="Apple-converted-space"> </span>[mailto:jose-bounces@ietf.org]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Manger, James H<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, May 17, 2012 9:49 PM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:jose@ietf.org" style="color: blue; text-decoration: underline; ">jose@ietf.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[jose] Is an OpenID Connect request really a JWT?<o:p></o:p></span></div></div></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">OpenID Connect [<a href="http://openid.net/specs/openid-connect-standard-1_0.html#req_param_method" style="color: blue; text-decoration: underline; ">http://openid.net/specs/openid-connect-standard-1_0.html#req_param_method</a>] says:<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"> “The request parameter is a JWT encoded OpenID Request Object…<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"> The JWT object MAY be signed or signed and encrypted via JWS and JWE”<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">It gives the example below, which is a JWS with “typ”:”JWT”. The payload is a JSON object with 8 fields (response_type, client_id, redirect_uri, scope, state, nonce, userinfo (with lots of sub-fields), id_token (with sub-fields)). The payload has none of the 8 reserved claims from the JWT spec (exp, nbf, iat, iss, aud, prn, jti, typ).<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">Can we really call that a JWT?<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">It seems implausible that the 8 fields in this example (response_type…) are supposed to be treated as “Private Claim Names” as per the JWT spec.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">We have two totally separate ideas both being called “JWT”.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0.5in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in; "><span lang="EN-AU"><span>1.<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span lang="EN-AU">JSON object carrying a bunch of claims.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0.5in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in; "><span lang="EN-AU"><span>2.<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span lang="EN-AU">A base64-based way to package any blob of bytes in unprotected, signed, or encrypted forms.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">Suggestion: use “JWT” for #2; pick a new name for #1 (perhaps JSON Claim Set); lots of changes to spec text.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; ">JWT algorithm = HS256<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; ">HMAC HASH Key = 'aaa'<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "><o:p> </o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; ">JSON Encoded Header = "{"alg":"HS256","typ":"JWT"}"<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; ">JSON Encoded Payload = "{"response_type":"code id_token",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "client_id":"s6BhdRkqt3",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "redirect_uri":"<a href="https://client.example.com/cb" style="color: blue; text-decoration: underline; ">https://client.example.com/cb</a>",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "scope":"openid profile",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "state":"af0ifjsldkj",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "nonce":"n-0S6_WzA2Mj",<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "userinfo":{"claims":{"name":null,"nickname":{"optional":true},<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "email":null,"verified":null,<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "picture":{"optional":true}}},<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> "id_token":{"max_age":86400,"claims":{"acr":{"values":["2"]}}}<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "><o:p> </o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; ">JWT = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXNwb25zZV90eXBlIjoiY29kZ<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> SBpZF90b2tlbiIsImNsaWVudF9pZCI6InM2QmhkUmtxdDMiLCJyZWRpcmVjdF91cmkiO<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> iJodHRwczpcL1wvY2xpZW50LmV4YW1wbGUuY29tXC9jYiIsInNjb3BlIjoib3BlbmlkI<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> HByb2ZpbGUiLCJzdGF0ZSI6ImFmMGlmanNsZGtqIiwibm9uY2UiOiJuLTBTNl9XekEyT<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> WoiLCJ1c2VyaW5mbyI6eyJjbGFpbXMiOnsibmFtZSI6bnVsbCwibmlja25hbWUiOnsib<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> 3B0aW9uYWwiOnRydWV9LCJlbWFpbCI6bnVsbCwidmVyaWZpZWQiOm51bGwsInBpY3R1c<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> mUiOnsib3B0aW9uYWwiOnRydWV9fX0sImlkX3Rva2VuIjp7Im1heF9hZ2UiOjg2NDAwL<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> CJjbGFpbXMiOnsiYWNyIjp7InZhbHVlcyI6WyIyIl19fX19.ou2Yc1B9a5iZLqbzBxE9<o:p></o:p></span></pre><pre style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: rgb(204, 204, 204); "><span lang="EN-AU" style="font-size: 12pt; color: black; "> 5aNS0pSfRClCqM77n85ehGo<o:p></o:p></span></pre><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">--<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU">James Manger<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-AU"><o:p> </o:p></span></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: blue; text-decoration: underline; ">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: blue; text-decoration: underline; ">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></span></blockquote></div><br></div></body></html>