<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body style="word-wrap:break-word" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Thanks John!
<div><br>
</div>
<div>I am very sorry that I could not make it to the call.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
<div><br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF875105" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> John Bradley [ve7jtb@ve7jtb.com]<br>
<b>Sent:</b> Wednesday, January 22, 2014 1:39 PM<br>
<b>To:</b> Preibisch, Sascha H<br>
<b>Cc:</b> openid-specs-native-apps@lists.openid.net<br>
<b>Subject:</b> Re: [Openid-specs-native-apps] A few questions<br>
</font><br>
</div>
<div></div>
<div><br>
<div>
<div>On Jan 22, 2014, at 2:49 AM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>Hi Paul, John and others!</div>
<div><br>
</div>
<div>I read through the second draft of the „draft-native-application-agent-core-01“ document. I find it very interesting and I like the idea of a TA. I think on a long run it is difficult to implement mobile SSO without that if multiple plattforms should be
supported.</div>
<div><br>
</div>
<div>I would like to leave some comments and ask a few questions though. If they have been discussed please let me know. I have ordered the questions by chapter:</div>
<div><br>
</div>
<div>7.2.1 </div>
<div>- sounds like the RS needs a list of "associated" secondary apps for each TA. This sounds like a challenging task</div>
</div>
</div>
</blockquote>
<div><br>
</div>
The AppInfo endpoint is associated with the AS and is probably used in a more enterprise or Personal data-locker type environment where there is a curated list of apps that the AS supports issuing tokens for. For unknown apps you would probably ask for a
id_token with the apps AS as the audience.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div><br>
</div>
<div>7.2.2</div>
<div>- typo? refresh_token should probably be access_token?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
Yes Fixed<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>- who and how is the list of apps mainted that is accessible for the end-user?</div>
<div>- "if" using a custom url scheme? What else should be used when "code" is in use?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
That is referring to using a custom URL scheme for passing the token from the TA to the app. The "customurl" value is the same as the one that the native app client has registered.</div>
<div>This may need to move to bindings.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>- is "scope" nescessary if a custom url is also and already configured to identify a secondary app?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
Yes the scope is used in the refresh token flow to get the access token for the app. That is separate from the custom scheme used as a app callback.</div>
<div>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div><br>
</div>
<div>7.4 Not sure if I really understand it:</div>
<div>- why is the primary refresh_token used to request secondary tokens?</div>
</div>
</div>
</blockquote>
If the TA doesn't need to re-authenticate the user it can use it's refresh token along with the scope from the appInfo endpoint.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>- does the secondary app need to povide any credentials?</div>
</div>
</div>
</blockquote>
That is probably a question for bindings. In some environments it may be possible to check the bundle signature. For a native app I don't know that burning a secret into the app accomplishes any real security.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>- do the secondary apps and the TA need some kind of relationship, trust?</div>
</div>
</div>
</blockquote>
YEs the TA should ideally be able to check the app bundle sig. I don't know if the secondary app needs to have trust beyond the user installing the correct TA or MDM. The secondary apps are not sending secrets to the TA.</div>
<div><br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>- why should the secondary app not request its own tokens directly using the id_token of the TA to authenticate the user?</div>
<div><br>
</div>
</div>
</div>
</blockquote>
That is a use case where the secondary app requests a id_token with a 3rd party as the audience and itself as the "azp" , It probably depends on the trust model. This is how Google Play store apps work. The secondary app should use a assertion flow to get
the access token. There may need to be a OAuth extension to pass the id_token in a authorization flow if user interaction is required.</div>
<div><br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>7.4.2 "binding the secondary token to the secondary app cryptographically". Sounds difficult</div>
</div>
</div>
</blockquote>
<div><br>
</div>
If the environment has secure storage then it may be possible for the app to expose it's public key to the TA and then have the AS generate proof of possession access tokens.</div>
<div>That token format is being developed in the OAuth WG <a href="http://tools.ietf.org/html/draft-tschofenig-oauth-hotk-03" target="_blank">
http://tools.ietf.org/html/draft-tschofenig-oauth-hotk-03</a> </div>
<div><br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div><br>
</div>
<div>I think one of the biggest callenges will be the secure connection between the TA, the secondary apps and the AS/ RS.</div>
</div>
</div>
</blockquote>
<div><br>
</div>
The secondary apps should only be talking directly to the TA and RS if they are known to the TA, We should consider an advanced case where one TA talks to a number of AS.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div><br>
</div>
<div>In order to have a separation of concerns I would appreciate a solution which separates between tokens for an app and tokens identifying an authenticated user. Technically there may not be a big difference but I do believe that semantically wise there
is. </div>
<div><br>
</div>
</div>
</div>
</blockquote>
Is that differentiating between a id_token passed to a secondary app vs a access token? </div>
<div>I think we have that but perhaps it needs to be clearer.<br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div>I believe that whenever an app requests an access_token it needs the users consent. This in form of username/ password or an id_token. I am not so sure about a refresh_token which wasn't issued to the requesting app.</div>
</div>
</div>
</blockquote>
<div><br>
</div>
I think the idea is to get consent when a app asks for a access token the first time if there is not some sort of pre-consent mechanism in place. That consent might be collected locally on the device or require a redirect to the AS for authentication and consent
depending on the model.</div>
<div><br>
</div>
<div><br>
</div>
<div>We can discuss further on today's call.</div>
<div><br>
<blockquote type="cite">
<div bgcolor="#FFFFFF" style="font-family:Helvetica; font-size:12px; font-style:normal; font-variant:normal; font-weight:normal; letter-spacing:normal; line-height:normal; orphans:auto; text-align:start; text-indent:0px; text-transform:none; white-space:normal; widows:auto; word-spacing:0px">
<div style="direction:ltr; font-family:Tahoma; font-size:10pt">
<div><br>
</div>
<div>This is it for the moment. I will try to take part at the next telco.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
</div>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net" target="_blank">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-native-apps" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a><br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>