<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Helvetica, Arial, sans-serif">Hi Torsten,<br>
<br>
Thanks so much for reading through the proposal!<br>
<br>
I wanted to ensure that each client had it's own refresh_token. I
consider refresh_tokens to be bound to the client_id of the client
both for metric purposes and well as security. For instance, if a
client_id starts mis-behaving I want to be able to disable the
client_id and in doing so effectively revoke all tokens issued to
that client_id.<br>
<br>
Maybe not required, but that was my rationale:)<br>
<br>
Thanks,<br>
George<br>
</font><br>
<div class="moz-cite-prefix">On 3/9/19 9:58 AM, Torsten Lodderstedt
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:5C6BAFB3-A458-4F4E-8896-626F1F7D8A50@lodderstedt.net">
<pre class="moz-quote-pre" wrap="">Hi George,
I read your proposal and I (believe to) understand that the device secret is introduced as kind of a device identifier (+ some additional data) grouping tokens issued to different apps residing on the same device.
A question popped up: Why do you use an id token and the token exchange to obtain fresh access tokens? Wouldn't it be sufficient to share the refresh token among those apps? Even if the refresh token is rotated, the legit apps are supposed to share some state on the device, so any of those apps could use the currently valid refresh token to perform the flow (again).
best regards,
Torsten.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Am 08.01.2019 um 00:22 schrieb George Fletcher via Openid-specs-ab <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab@lists.openid.net"><openid-specs-ab@lists.openid.net></a>:
Per the working group call today, bumping to the top of the list.
-------- Forwarded Message --------
Return-Path: <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab-bounces@lists.openid.net"><openid-specs-ab-bounces@lists.openid.net></a>
Received: from silver.osuosl.org (mpq410.aol.prodcr.mail.ne1.yahoo.com [140.211.166.136]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mtaiw-mbd02.mx.aol.com (Internet Inbound) with ESMTPS id 15F89700000B2 for <a class="moz-txt-link-rfc2396E" href="mailto:gffletch@aol.com"><gffletch@aol.com></a>; Fri, 22 Jun 2018 13:30:26 -0400 (EDT)
X-Apparently-To: <a class="moz-txt-link-abbreviated" href="mailto:gffletch@aol.com">gffletch@aol.com</a>; Fri, 22 Jun 2018 17:30:25 +0000
Date: Fri, 22 Jun 2018 13:30:08 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.8.0
Subject: [Openid-specs-ab] Submission: Native SSO for Mobile Apps (txt and xml)
From: George Fletcher via Openid-specs-ab <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab@lists.openid.net"><openid-specs-ab@lists.openid.net></a>
Reply-To: George Fletcher <a class="moz-txt-link-rfc2396E" href="mailto:gffletch@aol.com"><gffletch@aol.com></a>
Sender: "Openid-specs-ab" <a class="moz-txt-link-rfc2396E" href="mailto:openid-specs-ab-bounces@lists.openid.net"><openid-specs-ab-bounces@lists.openid.net></a>
Per the notes from Thursday's OpenID Connect working group call, here are text and xml formatted version of the Native SSO for Mobile apps spec.
Please note, the core text is here but this is no where near final. Note that the text for additions for dynamic client registration and other IANA registrations are text from the "front channel logout" spec. I left the sections there as they will likely be needed.
The purpose here is to get the core text in the proper format.
Thanks,
George
--
Identity Standards Architect
Verizon Media Work: <a class="moz-txt-link-abbreviated" href="mailto:george.fletcher@oath.com">george.fletcher@oath.com</a>
Mobile: +1-703-462-3494 Twitter: <a class="moz-txt-link-freetext" href="http://twitter.com/gffletch">http://twitter.com/gffletch</a>
Office: +1-703-265-2544 Photos: <a class="moz-txt-link-freetext" href="http://georgefletcher.photography">http://georgefletcher.photography</a>
<openid-connect-native-sso-1_0.txt><openid-connect-native-sso-1_0.xml><Attached Message Part.txt>_______________________________________________
Openid-specs-ab mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Openid-specs-ab@lists.openid.net">Openid-specs-ab@lists.openid.net</a>
<a class="moz-txt-link-freetext" href="http://lists.openid.net/mailman/listinfo/openid-specs-ab">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
<br>
</body>
</html>