<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-CA" link="blue" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">The CEBA spec requires client authentication at the token endpoint. That could include JWT authentication.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There is a alternate proposal using a signed JWT to the token endpoint in the JWT assertion flow.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It may be that the OAuth JAR is a compromise between the two.
</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have the question of why HTTP basic authentication is bad and should asymmetric authentication more in line with FAPI’s requirements for banks authentication of clients be required.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If in the discussion today there is agreement that the request should be a signed JWT, then the finer points of what endpoint it is posted to and what is returned can be considered.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Performance is a concern.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think the goal is to have one POST by the client that returns a artifact for polling, or triggers a post back.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Fitting request by JAR into that may not be a perfect fit for flow as it currently requires a redirect of the user to the authorization endpoint with the artifact. In the backchannel the extra call wont have any value.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A possibility is to have a new backchannel authorization endpoint like the device flow, but require the authorization request to be a JAR, and skip the separate client authentication. It would then return a artifact for polling or the
IdP postback.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Lets see how the conversation goes today.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">John B.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sent from <a href="https://go.microsoft.com/fwlink/?LinkId=550986">
Mail</a> for Windows 10</p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="border:none;padding:0cm"><b>From: </b><a href="mailto:Bjorn.Hjelm@VerizonWireless.com">Hjelm, Bjorn</a><br>
<b>Sent: </b>May 12, 2017 7:53 AM<br>
<b>To: </b><a href="mailto:n-sakimura@nri.co.jp">Nat Sakimura</a><br>
<b>Cc: </b><a href="mailto:Openid-specs-mobile-profile@lists.openid.net">Openid-specs-mobile-profile@lists.openid.net</a>;
<a href="mailto:ve7jtb@ve7jtb.com">John Bradley</a><br>
<b>Subject: </b>Re: [E] [Openid-specs-mobile-profile] CIBA - Backchannel Authentication Endpoint and OIDC request object endpoint</p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span style="font-family:"Arial",sans-serif">Nat,</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<div id="AppleMailSignature">
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span style="font-family:"Arial",sans-serif">I don't see a reason why we wouldn't address this in MODRNA WG but I'll let John and authors of the CIBA specification share their view
as well.<br>
<br>
BR<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span style="font-family:"Arial",sans-serif">Bjorn<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;text-align:justify;text-justify:inter-ideograph">
<span style="font-family:"Arial",sans-serif"><br>
On May 12, 2017, at 7:41 AM, Nat Sakimura <<a href="mailto:n-sakimura@nri.co.jp"><span style="color:#0563C1">n-sakimura@nri.co.jp</span></a>> wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">Hi</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">OIDC core defines request_uri. It does not define a particular way of setting up the endpoint that receives
request object but just says that it needs to save the request object. </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">CIBA’s Backchannel Authentication Endpoint is very close to it except that it is not accepting the signed
JWS. </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">FAPI Part 2 defined an endpoint at the AS that saves the request object.
</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">See
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__bitbucket.org_openid_fapi_src_master_Financial-5FAPI-5FWD-5F002.md-3Fat-3Dmaster-26fileviewer-3Dfile-2Dview-2Ddefault-23markdown-2Dheader-2D7-2Drequest-2Dobject-2Dendpoint&d=DwMFAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=qocRaYy7s_jOV6AWy-D-mHLe3ExW_NILg6DnwYCSDAU&s=XHdzArxfIyPbLTVdoRDeFlnm6SBhs-rw124VyB0ig3w&e=">
<span style="color:#0563C1">https://bitbucket.org/openid/fapi/src/master/Financial_API_WD_002.md?at=master&fileviewer=file-view-default#markdown-header-7-request-object-endpoint</span></a></span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">I and John were talking of propagating it to OAuth JAR as well.
</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif">I kind of feel that these can be harmonized. Is there any appetite to do so in Modrna WG?
</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"">--</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"">PLEASE READ :This e-mail is confidential and intended for the</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"">named recipient only. If you are not an intended recipient,</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"MS Gothic"">please notify the sender and delete this e-mail.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-US" style="font-family:"Arial",sans-serif"> </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</div>
</blockquote>
<p class="MsoNormal" style="mso-margin-top-alt:5.0pt;margin-right:36.0pt;margin-bottom:5.0pt;margin-left:36.0pt">
<span style="font-size:10.5pt">_______________________________________________<br>
Openid-specs-mobile-profile mailing list<br>
<a href="mailto:Openid-specs-mobile-profile@lists.openid.net"><span style="color:#0563C1">Openid-specs-mobile-profile@lists.openid.net</span></a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dmobile-2Dprofile&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=qocRaYy7s_jOV6AWy-D-mHLe3ExW_NILg6DnwYCSDAU&s=PRjxSYL4lHzNjfUse2HZvysonuDQeR8YFQn9XzWio-4&e="><span style="color:#0563C1">https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dmobile-2Dprofile&d=DwICAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=NMZJHCV8pjvGIH2fTx9z6l7g7-V-a2xW7ISf9uHdz0A&m=qocRaYy7s_jOV6AWy-D-mHLe3ExW_NILg6DnwYCSDAU&s=PRjxSYL4lHzNjfUse2HZvysonuDQeR8YFQn9XzWio-4&e=</span></a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
</body>
</html>