<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText"><span style="color:#0070C0">Hi Roland. My replies are inline. I’ve cc’ed the mailing list to allow others to comment on my responses – especially the response about verifying the
</span>target_link_uri<span style="color:#0070C0"> value to prevent it from being an open redirector, which I’d like to hear other’s thoughts on.<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Roland Hedberg [mailto:roland.hedberg@adm.umu.se] <br>
Sent: Tuesday, June 10, 2014 11:03 PM<br>
To: Mike Jones<br>
Subject: Re: Notes from our interop conversation</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hi Mike,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">looked some more at the third party (OP) initiated login.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">A couple of questions:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">- target_link_uri redirect to after authentication.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">does that mean that no access token request are performed by the RP, just the authentication/authorization request.<o:p></o:p></p>
<p class="MsoPlainText">Sounds reasonable since this is only about authentication, right ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0">There’s intentionally nothing special about the authentication behavior when the RP sends an authentication request after receiving a third party initiated login request. The OP should do whatever it normally
does, given the request parameters used (such as the response_type, the scope values, the “claims” values, etc.). That will include returning an access token for most response_type values. Also, the RP is free to use the access token to obtain claims from
the UserInfo endpoint, if it desires, before redirecting to the </span>target_link_uri<span style="color:#0070C0"> location.<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">- the RP MUST verify the target_link_uri. What does this mean ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0">That’s a REALLY GOOD QUESTION. I don’t know what check the RP should apply to the
</span>target_link_uri<span style="color:#0070C0"> value to prevent it from being used as an open redirector. My first instinct was that it should check it against a list of values provided by the OP in its discovery document, but there are no such values
defined, and in fact, the initiator doesn’t have to be an OP. John, you wrote this language, I believe. What did you have in mind here?</span><o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">When the user is redirected back to the target_link_uri is there anything attached to that, like an id_token.<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0">No<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">What are the error messages if any ?<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0">No extra ones are defined. Given that the authentication requests/responses are the normal ones, no additional errors are needed for those. The redirects either succeed or fail, with normal browser errors
happening on failure.<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoPlainText">And finally, if RPs support third party login that could actually be used to test some of the RPs functionality.<o:p></o:p></p>
<p class="MsoPlainText">I could use the login_hint to carry testing information. Sneaky I know but .. :-)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0">Good idea. </span><span style="font-family:Wingdings;color:#0070C0">J</span><span style="color:#0070C0"><o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">-- Roland<o:p></o:p></p>
<p class="MsoPlainText">"Education is the path from cocky ignorance to miserable uncertainty.” - Mark Twain<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0"> -- Mike<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:#0070C0"><o:p> </o:p></span></p>
</div>
</body>
</html>