<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks for writing this up, Matias. I think it’s a useful set of text.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I disagree with your comment on my position “</span><span style="font-family:"Courier New"">[according to Mike, "azp" does not constraints though]</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">”
though… I believe that “azp” is intended to identify an additional authorized presenter of the token in the case where the authorized presenter is not the client to whom the token was issued. (It’s my assumption that the client to whom the token was issued
is also always an authorized presenter, but others should confirm that that is their understanding and intent as well.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Matias Woloski [mailto:matiasw@gmail.com]
<br>
<b>Sent:</b> Thursday, March 28, 2013 5:13 PM<br>
<b>To:</b> Nat Sakimura<br>
<b>Cc:</b> Mike Jones; openid-specs-ab<br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect and Identity Delegation<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">I took the opportunity to write down what I understood, taking ideas from Mike and Nat and adding the scenarios for context. Forgive my informality :) <o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<span style="font-family:"Courier New"">The authorized presenter (azp) is a party that can legally present the token to an audience. An audience (aud) is a party that the token can be legally presented to. In other words, "azp" constraints where the token
could come "from" and "aud" constraints where the token can be sent "to". [according to Mike, "azp" does not constraints though]<br>
<br>
Typically, this is useful in a scenario where an application running on a device needs to call a backend service and authenticate not only the user of the device but also the application calling it. In this scenario, the authorization server generates a token
like: { "aud": "backend-service-clientid", "azp": "device-client-id", "sub": "user" }. If the backend service does not check the "azp", any other app on the device could have obtained a token for that backend and successfully call this backend service.
<br>
<br>
Another scenario where this is useful is when delegating the identity of the user who has logged in to a web application which then calls a web service on behalf of the user. In this case, the original "user" id_token could be exchanged by an authorization
server for a new id_token targeted to the web service ("aud" = "web-service-clientid") and whose authorized party is only the web application ("azp" = "web-app-clientid"). In that way, the web service could check that the token is coming from a web application
it trusts.</span><o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Matias<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Mar 28, 2013 at 9:05 PM, Nat Sakimura <<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Could you point me to the text in OAuth spec describing it? <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also, there are legitimate cases where changing hands happens, which is not leaking. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">As long as the original party that has gotten the bearer token is consciously handing it to another client, it should be fine. e.g., sometimes connected client handing it to the server component that has a different client_id. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Nat<o:p></o:p></p>
<div>
<p class="MsoNormal">2013/3/29 Mike Jones <<a href="mailto:Michael.Jones@microsoft.com" target="_blank">Michael.Jones@microsoft.com</a>><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Changing hands doesn’t mean that it’s authorized. It just means that the token has been leaked to
an unauthorized party.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> -- Mike</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Nat Sakimura [mailto:<a href="mailto:sakimura@gmail.com" target="_blank">sakimura@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, March 28, 2013 4:51 PM<br>
<b>To:</b> Mike Jones<br>
<b>Cc:</b> Tim Bray; openid-specs-ab</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<b>Subject:</b> Re: [Openid-specs-ab] OpenID Connect and Identity Delegation<o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Which is not the case that it may sometime change the hand. The name bearer suggests otherwise as well. Bearer is whoever has it. <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">From Oxford Dictionary: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:9.0pt;font-family:"Georgia","serif";color:#333333;border:none windowtext 1.0pt;padding:0in;background:white">1</span></b><span style="font-size:9.0pt;font-family:"Georgia","serif";color:#333333;border:none windowtext 1.0pt;padding:0in;background:white">a
person or thing that carries or holds something:</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:9.0pt;font-family:"Georgia","serif";color:#333333;border:none windowtext 1.0pt;padding:0in;background:white">2</span></b><span style="font-size:9.0pt;font-family:"Georgia","serif";color:#333333;background:white">a
person who presents a cheque or other order to pay money:</span><o:p></o:p></p>
</div>
</blockquote>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">And here is a description of "bearer bond" from wikipedia: <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";background:white">A <b>bearer bond</b> is a debt security issued by a business entity, such as a corporation, or by
a government. It differs from the more common types of investment securities in that it is unregistered – no records are kept of the owner, or the transactions involving ownership. Whoever physically holds the paper on which the bond is issued owns the </span><a href="http://en.wikipedia.org/wiki/Financial_instrument" target="_blank" title="Financial instrument"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#0B0080;background:white;text-decoration:none">instrument</span></a><span style="font-size:10.0pt;font-family:"Arial","sans-serif";background:white">.
This is useful for </span><a href="http://en.wikipedia.org/wiki/Investor" target="_blank" title="Investor"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#0B0080;background:white;text-decoration:none">investors</span></a><span style="font-size:10.0pt;font-family:"Arial","sans-serif";background:white"> who
wish to retain anonymity. Recovery of the value of a bearer bond in the event of its loss, theft, or destruction is usually impossible. </span><o:p></o:p></p>
</div>
</blockquote>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">At the same time, bearer is more privacy preserving in some sense. In a "registered token", i.e., token with the "azp", it is impossible to hide who is presenting it. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">Nat<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal">-- <br>
Nat Sakimura (=nat)<o:p></o:p></p>
<div>
<p class="MsoNormal">Chairman, OpenID Foundation<br>
<a href="http://nat.sakimura.org/" target="_blank">http://nat.sakimura.org/</a><br>
@_nat_en<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Openid-specs-ab mailing list<br>
<a href="mailto:Openid-specs-ab@lists.openid.net" target="_blank">Openid-specs-ab@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>