<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">The redirect URI needs to be checked that it is inside the domain that the Client is willing to redirect to. Typically this is some known landing page or deep link.<div><br></div><div>This sort of functionality is similar to Shibboleth target or SAML 2.0 RelayState in IdP-Initiated SSO.</div><div><br></div><div>After a successful authentication The client needs to create a session and redirect the user agent to the target_link_uri. </div><div><br></div><div>Typically a Client might use state to store the target_link_uri in the Authorization request. </div><div>Clients that support his also need to preform some sort of sanity check on the target_link_uri, and never redirect without a positive authentication response.</div><div>An attacker can always modify state as it is not signed in the request. Generating a forged failed response can trick some SP/Clients into redirecting and that needs to be blocked.</div><div><br></div><div>That was one of the reasons I created. <a href="http://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state">http://tools.ietf.org/html/draft-bradley-oauth-jwt-encoded-state</a></div><div>As a way that a Client can prevent tampering with the target_uri (now that I think about it, target_link_uri might be a better name to be consistent with Connect)</div><div><br></div><div>It may be that using signed state directly from the IdP may be a simpler solution to the problem of IdP initiated login saving a number of round trips for the most common case.</div><div><br></div><div>For 3rd party the way we have it in the spec with the 3rd party initiating the flow at the client and the client being responsible for protecting the user and itself from forged authentication requests.</div><div><br></div><div>John B.</div><div><br></div><div><br></div><div><br><div><div>On Jun 11, 2014, at 3:58 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">Hi Roland. My replies are inline. I’ve cc’ed the mailing list to allow others to comment on my responses – especially the response about verifying the<span class="Apple-converted-space"> </span></span>target_link_uri<span style="color: rgb(0, 112, 192);"><span class="Apple-converted-space"> </span>value to prevent it from being an open redirector, which I’d like to hear other’s thoughts on.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">-----Original Message-----<br>From: Roland Hedberg [<a href="mailto:roland.hedberg@adm.umu.se" style="color: purple; text-decoration: underline;">mailto:roland.hedberg@adm.umu.se</a>]<span class="Apple-converted-space"> </span><br>Sent: Tuesday, June 10, 2014 11:03 PM<br>To: Mike Jones<br>Subject: Re: Notes from our interop conversation</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Hi Mike,<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">looked some more at the third party (OP) initiated login.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">A couple of questions:<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">- target_link_uri redirect to after authentication.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">does that mean that no access token request are performed by the RP, just the authentication/authorization request.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Sounds reasonable since this is only about authentication, right ?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">There’s intentionally nothing special about the authentication behavior when the RP sends an authentication request after receiving a third party initiated login request. The OP should do whatever it normally does, given the request parameters used (such as the response_type, the scope values, the “claims” values, etc.). That will include returning an access token for most response_type values. Also, the RP is free to use the access token to obtain claims from the UserInfo endpoint, if it desires, before redirecting to the<span class="Apple-converted-space"> </span></span>target_link_uri<span style="color: rgb(0, 112, 192);"><span class="Apple-converted-space"> </span>location.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">- the RP MUST verify the target_link_uri. What does this mean ?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">That’s a REALLY GOOD QUESTION. I don’t know what check the RP should apply to the<span class="Apple-converted-space"> </span></span>target_link_uri<span style="color: rgb(0, 112, 192);"><span class="Apple-converted-space"> </span>value to prevent it from being used as an open redirector. My first instinct was that it should check it against a list of values provided by the OP in its discovery document, but there are no such values defined, and in fact, the initiator doesn’t have to be an OP. John, you wrote this language, I believe. What did you have in mind here?</span><o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">When the user is redirected back to the target_link_uri is there anything attached to that, like an id_token.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">No<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">What are the error messages if any ?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">No extra ones are defined. Given that the authentication requests/responses are the normal ones, no additional errors are needed for those. The redirects either succeed or fail, with normal browser errors happening on failure.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">And finally, if RPs support third party login that could actually be used to test some of the RPs functionality.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I could use the login_hint to carry testing information. Sneaky I know but .. :-)<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);">Good idea.<span class="Apple-converted-space"> </span></span><span style="font-family: Wingdings; color: rgb(0, 112, 192);">J</span><span style="color: rgb(0, 112, 192);"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">-- Roland<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">"Education is the path from cocky ignorance to miserable uncertainty.” - Mark Twain<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> -- Mike<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(0, 112, 192);"> </span></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></blockquote></div><br></div></body></html>