<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body bgcolor="#FFFFFF" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div>Hi Paul, John and others!</div>
<div><br>
</div>
<div>I read through the second draft of the „draft-native-application-agent-core-01“ document. I find it very interesting and I like the idea of a TA. I think on a long run it is difficult to implement mobile SSO without that if multiple plattforms should be
supported.</div>
<div><br>
</div>
<div>I would like to leave some comments and ask a few questions though. If they have been discussed please let me know. I have ordered the questions by chapter:</div>
<div><br>
</div>
<div>7.2.1 </div>
<div>- sounds like the RS needs a list of "associated" secondary apps for each TA. This sounds like a challenging task</div>
<div><br>
</div>
<div>7.2.2</div>
<div>- typo? refresh_token should probably be access_token?</div>
<div>- who and how is the list of apps mainted that is accessible for the end-user?</div>
<div>- "if" using a custom url scheme? What else should be used when "code" is in use?</div>
<div>- is "scope" nescessary if a custom url is also and already configured to identify a secondary app?</div>
<div><br>
</div>
<div>7.4 Not sure if I really understand it:</div>
<div>- why is the primary refresh_token used to request secondary tokens?</div>
<div>- does the secondary app need to povide any credentials?</div>
<div>- do the secondary apps and the TA need some kind of relationship, trust?</div>
<div>- why should the secondary app not request its own tokens directly using the id_token of the TA to authenticate the user?</div>
<div><br>
</div>
<div>7.4.2 "binding the secondary token to the secondary app cryptographically". Sounds difficult</div>
<div><br>
</div>
<div>I think one of the biggest callenges will be the secure connection between the TA, the secondary apps and the AS/ RS.</div>
<div><br>
</div>
<div>In order to have a separation of concerns I would appreciate a solution which separates between tokens for an app and tokens identifying an authenticated user. Technically there may not be a big difference but I do believe that semantically wise there
is. </div>
<div><br>
</div>
<div>I believe that whenever an app requests an access_token it needs the users consent. This in form of username/ password or an id_token. I am not so sure about a refresh_token which wasn't issued to the requesting app.</div>
<div><br>
</div>
<div>This is it for the moment. I will try to take part at the next telco.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
</div>
</body>
</html>