<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-tab-span
{mso-style-name:apple-tab-span;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks Amanda. I’ve created
<a href="http://hg.openid.net/connect/issue/723/messages-amanda-anganes-review-issues">
http://hg.openid.net/connect/issue/723/messages-amanda-anganes-review-issues</a> to track your comments.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> openid-specs-ab-bounces@lists.openid.net [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>Anganes, Amanda L<br>
<b>Sent:</b> Friday, January 25, 2013 12:12 PM<br>
<b>To:</b> openid-specs-ab@lists.openid.net<br>
<b>Subject:</b> [Openid-specs-ab] openid-connect-messages-1_0-15 review<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">Messages release candidate review. Comments are ordered by section number.<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">1.2 Authentication context definition: "…before it makes an entitlement_s_ decision" => "…before it makes an entitlement decision"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">1.3 step 5: "_The_ UserInfo Endpoint…" All other steps start with "the". <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2. opening sentence is awkward, suggest rewording: "The OpenID Connect protocol defines several endpoints, which the RP interacts with
in order to accomplish its goal of obtaining claims from the OP." <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2. step 1 last sentence: "When id_token was specified" => "If id_token was specified" OR "When id_token is specified"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.1.1 3rd sentence "Section 4.1.1 and 4.2.2 of OAuth 2.0 defines …" => "Sections 4.11 and 4.22 of OAuth 2.0 define"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.1.1.1.2 2nd paragraph "Following Claims" => "The following Claims"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.1.1.1.3 "The Client may request additional Claims on voluntary basis that it requires to perform other tasks offered to the user." What
is this sentence adding? Grammar is off but I'm not sure what it is trying to add to the section. Remove it?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">Formatting for member values of "null" or "A JSON Object" is off. Not formatted like other definition lists in the document.<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.1.2.1 auth_time definition mentions Request Object semantics (If requested with {"essential" : true} then the claim is REQUIRED). Why
does this optional claim get this clause while none of the other optional claims do? Pull it out or add it to all other OPTIONAL Claims. <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.2 "..to obtain Access Token Response" => "…to obtain _an_ Access Token Response"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.2.1 client_secret_jwt definition, 3rd sentence "The Client Authenticates" => "The Client authenticates"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">The paragraph at the end of client_secret_jwt definition specifies value of "client_assertion_type" and "client_assertion", which are
NOT included in the list of required claims in this document. The claims listing currently states "The JWT MUST contain the following REQUIRED Claims and MAY contain the following OPTIONAL Claims:" but should instead say "In addition to any REQUIRED and OPTIONAL
claims specified by OAuth JWT Bearer Token Profiles and OAuth 2.0 Assertion Profile, the JWT MUST contain the following…" It might be worthwhile to additionally specify on the "client_assertion" and "client_assertion_type" claim requirements that those claims
are specified in the referenced docs. <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">The private_key_jwt section has the same problem.<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2.4 offline_access definition "…access token that grants access _to_ the End-User's UserInfo endpoint…" <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">3.1 "Each parameter MAY have JSON Structure as its value." Should this be "Each parameter MAY have a JSON structure as its value"?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">4.2 Delete fragment "The related elements are:" from the first line. <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">Provider x509_url, x509_encryption_url, and Client x509_encryption_url definitions are all missing end periods.<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">5.1.1 "MUST decode the JWT in accordance with _the_ JSON Web Encryption specification"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">5.1.3 step 1 change "the unsupported Claims" to "any unsupported Claims". <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">5.2 step 10 "…a nonce Claim MUST be present and its value of the checked to verify" => "a nonce Claim MUST be present and its value checked
to verify"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">6. "The user MUST always explicitly consent to the return of a Refresh Token that enables offline access", but the Authorization Server
"SHOULD explicitly receive user consent for all clients when the registered application_type is native". This seems contradictory; am I missing something?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.1 "…a request may be disclosed to an attacker posing security and privacy threat" => "…a request may be disclosed to an attacker, posing
a security and privacy threat"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">"This works even against a compromised user-agent in the case of indirect request." => "This protects against even a compromised user-agent
in the case of an indirect request."<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.6 "Since…malicious Client to send _a_ request to a wrong party"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">"To mitigate…require that the request to be digitally signed…using" => "To mitigate…require that the request be digitally signed…using"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.8 is an Authorization Code really an example of possible token reuse, as it is not a token (maybe a question of semantics) and is already
required by OAuth 2.0 section 10.5 to be single-use only? <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.9 OAuth SC needs to be called out with a proper reference/hyperlink. "it" in the first sentence should be replaced with "an authorization
code", and/or the whole thing could be rewritten. It reads like an unfinished thought. <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.10 2nd paragraph "Responses to token requests is bound" => "Responses to token requests are bound"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.11 <o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">"A timing attack is an attack that allows the attacker to obtain an unnecessary large amount of information" => "A timing attack allows
an attacker to obtain an unnecessarily large amount of information"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">2nd paragraph, should "instance of the finding error" be "instance of finding the error"?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">9.16 comma in title is unnecessary<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">If providing refresh token revocation (which is not mentioned anywhere else in this document) is required, shouldn't the revocation document
be referenced? It feels odd for a MUST to be placed here w/o further information, as things like a revocation endpoint and revocation request message(s) are not described by this document. Maybe it should have the phrase "The details of such a mechanism are
out of scope of this document"?<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">Appendix A: Breno's name is mis-placed, should be above Casper for alphabetical order by first name<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black">--Amanda<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;min-height: 14.0px"><span style="font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>