<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">If we always pass the value to the AS then I suppose that sending the value to the TA via the appinfo endpoint becomes mostly used as a key to look up information about the app for creating a UI, rather than as a security check in itself.<div><br></div><div>If we follow that line of thought we would need rules for encoding the various versions of package name as a URI safe parameter and avoid naming collisions between the namespaces.</div><div><br></div><div>eg ios-(base64url encoded bundle_id)</div><div><br></div><div>So the question is if the identifier for the app form a OS perspective is derefrenced to a app name in the TA by a lookup from the app_unfo endpoint, or the raw identifier passed to the AS and mapped to a app at that end?</div><div><br></div><div>John B.<br><div><br><div><div>On Jul 31, 2014, at 7:47 PM, Emily Xu <<a href="mailto:exu@vmware.com">exu@vmware.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-size: 14px; font-family: Calibri, sans-serif;">
<div>Right. I just confirmed from my AirWatch colleague, TA could validate a native app's bundle id or package name. However, it is AS who holds the truth about which native app (identified by bundle id or package name) is authorized to receive tokens. So we
should allow an AS to do the authorization check, but let TA do the bundle id/package name validation.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Emily</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align: left; border-width: 1pt medium medium; border-style: solid none none; padding: 3pt 0in 0in; border-top-color: rgb(181, 196, 223);">
<span style="font-weight:bold">From: </span>John Bradley <<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, July 31, 2014 2:46 PM<br>
<span style="font-weight:bold">To: </span>"Preibisch, Sascha H" <<a href="mailto:Sascha.Preibisch@ca.com">Sascha.Preibisch@ca.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>" <<a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-native-apps] Bundle ID?<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
In the draft I worked on prior to CIS, I put in the bundle_id value in the app_info response as a way to identify a native app.
<div>The previous draft relied only on the redirect_uri for the app and that is not as secure as one would hope.</div>
<div><br>
</div>
<div>bundle_id i think came from the IOS demo app we were looking at.</div>
<div><br>
</div>
<div>We have a couple of choices given that the AS needs to likely support the same app across multiple OS.</div>
<div>The app Info can return multiple os specific values eg bundle_id for iOS and package_name for android, or we could make the AS responsible for informing the app_info endpoint what OS the TA making the request is running on so it can put the correct value
in a generic parameter like app_id.</div>
<div><br>
</div>
<div>Using a generic app_id will make the app_info endpoint a bit more complicated as it needs to return a response per user+platform vs just per user.</div>
<div><br>
</div>
<div>When I picked the name I was personally thinking that multiple values were the way to go.</div>
<div><br>
</div>
<div>As a WG we can go either way.</div>
<div><br>
</div>
<div>The other thing to consider is that VMWare was thinking that some TA won't be building a desktop to invoke apps. </div>
<div><br>
</div>
<div>They would like to have a simple option of using the verified bundle_id or package_name as the identifier for the app in the request to the token endpoint rather than having the TA mapping from bundle_id to scope.</div>
<div> </div>
<div>Note I am currently working to update the draft to move the identifier for the client app from a scope value to a separate "azp" (authorized party) parameter in the request to the token endpoint.</div>
<div>Some people felt that overloading scope to identify the app making the request to the TA was a bit too much overloading.</div>
<div><br>
</div>
<div>John B</div>
<div><br>
</div>
<div>
<div>
<div>On Jul 31, 2014, at 4:57 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div fpstyle="1" ocsi="0" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word;">
<div style="direction: ltr; font-family: Tahoma; font-size: 10pt;">I personally think that, whenever possible and appropriate, the goal should be to keep the terminology simple. If the spec. should be generic enough for "any" plattfom I still think a generic
name like app_id would work fine.
<div><br>
</div>
<div>As you said, the value may not be the same, but the concept behind it is the same (identifying an app).</div>
<div><br>
</div>
<div>Sascha<br>
<div><br>
<div class="BodyFragment"><font size="2"><span style="font-size: 10pt;">
<div class="PlainText">CA Technologies<br>
Sascha Preibisch, Principal Software Engineer<br>
Mobile Access Gateway<br>
<a href="mailto:sascha.preibisch@ca.com">sascha.preibisch@ca.com</a></div>
</span></font></div>
</div>
<div style="font-family: 'Times New Roman'; font-size: 16px;">
<hr tabindex="-1">
<div id="divRpF5994" style="direction: ltr;"><font face="Tahoma" size="2"><b>From:</b><span class="Apple-converted-space"> </span>David Waite [<a href="mailto:david@alkaline-solutions.com">david@alkaline-solutions.com</a>]<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 31, 2014 1:04 PM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Preibisch, Sascha H<br>
<b>Cc:</b><span class="Apple-converted-space"> </span>Chuck Mortimore; Paul Madsen;<span class="Apple-converted-space"> </span><a href="mailto:openid-specs-native-apps@lists.openid.net">openid-specs-native-apps@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-native-apps] Bundle ID?<br>
</font><br>
</div>
<div></div>
<div>It sounds like the value would not likely be the same on both platforms, so perhaps bundle id is appropriate on iOS and package name (or signing fingerprint) would be appropriate on android?
<div><br>
</div>
<div>-DW</div>
<div><br>
<div>
<div>On Jul 31, 2014, at 12:18 PM, Preibisch, Sascha H <<a href="mailto:Sascha.Preibisch@ca.com" target="_blank">Sascha.Preibisch@ca.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="auto" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;">
<div style="direction: ltr; font-family: Tahoma; font-size: 10pt;">I had a chat with our iOS and Android developers.
<div><br>
</div>
<div>bundle_id is only known on iOS. On Android the equivalent is package_name. The Android developer said that bundle_id would be very confusing in his environment.</div>
<div><br>
</div>
<div>Both suggested a generic term like "app_id" which would be explained in the "Terminology" section.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha<br>
<div><br>
<div class="BodyFragment"><font size="2"><span style="font-size: 10pt;">
<div class="PlainText">CA Technologies<br>
Sascha Preibisch, Principal Software Engineer<br>
Mobile Access Gateway<br>
<a href="mailto:sascha.preibisch@ca.com" target="_blank">sascha.preibisch@ca.com</a></div>
</span></font></div>
</div>
<div style="font-family: 'Times New Roman'; font-size: 16px;">
<hr tabindex="-1">
<div id="divRpF328776" style="direction: ltr;"><font face="Tahoma" size="2"><b>From:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-native-apps-bounces@lists.openid.net" target="_blank">openid-specs-native-apps-bounces@lists.openid.net</a><span class="Apple-converted-space"> </span>[<a href="mailto:openid-specs-native-apps-bounces@lists.openid.net" target="_blank">openid-specs-native-apps-bounces@lists.openid.net</a>]
on behalf of Chuck Mortimore [<a href="mailto:cmortimore@salesforce.com" target="_blank">cmortimore@salesforce.com</a>]<br>
<b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, July 31, 2014 8:23 AM<br>
<b>To:</b><span class="Apple-converted-space"> </span>Paul Madsen<br>
<b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openid-specs-native-apps@lists.openid.net" target="_blank">openid-specs-native-apps@lists.openid.net</a><br>
<b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openid-specs-native-apps] Bundle ID?<br>
</font><br>
</div>
<div></div>
<div>
<div>iOS. I believe on Android we'd capture a cert hash, but it's been awhile so the platform may have evolved since our last research <br>
</div>
<div><br>
On Jul 31, 2014, at 4:23 AM, Paul Madsen <<a href="mailto:paul.madsen@gmail.com" target="_blank">paul.madsen@gmail.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite"><font size="+1"><font face="Arial">the latest spec introduces the bundle id parameter as a means of distinguishing applications<br>
<br>
<a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v1/url?u=http://openid.bitbucket.org/draft-native-application-agent-core-01-working-draft.html&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=QMUCjVY9UHNMhU7U8LLSBdCwwjJmrhqydxP2GMraQAU%3D%0A&s=bd5e919e7fbf1b40de984df593ea8e89961600541f5c31b578337aa5b346f1b7" target="_blank">http://openid.bitbucket.org/draft-native-application-agent-core-01-working-draft.html</a><br>
<br>
</font></font><font size="+1"><font face="Arial"></font></font><small><font face="Courier New,Courier,monospace">bundle_id</font></small><font size="+1"><font face="Arial"></font></font><dd>
<font size="+1"><font face="Arial"><small><font face="Courier New,
Courier,monospace">OPTIONAL (String). This is a string that the TA uses to validate the identity of the invoking application. This is RECOMMENDED if the "type" is "native"</font></small></font></font></dd><dt><font size="+1"><font face="Arial"><br>
Is this term appropriately generic across the mobile OSs? or is it specific to iOS?<br>
<br>
paul<br>
<br>
<br>
</font></font></dt></blockquote>
<blockquote type="cite"><span>_______________________________________________</span><br>
<span>Openid-specs-native-apps mailing list</span><br>
<span><a href="mailto:Openid-specs-native-apps@lists.openid.net" target="_blank">Openid-specs-native-apps@lists.openid.net</a></span><br>
<span><a href="https://urldefense.proofpoint.com/v1/url?u=http://lists.openid.net/mailman/listinfo/openid-specs-native-apps&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=QMUCjVY9UHNMhU7U8LLSBdCwwjJmrhqydxP2GMraQAU%3D%0A&s=8fc29785f674089a24e266ba0e5178bf5f570735bb1bf418b54fab21dfcee160" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a></span><br>
</blockquote>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net" target="_blank">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v1/url?u=http://lists.openid.net/mailman/listinfo/openid-specs-native-apps&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=QMUCjVY9UHNMhU7U8LLSBdCwwjJmrhqydxP2GMraQAU%3D%0A&s=8fc29785f674089a24e266ba0e5178bf5f570735bb1bf418b54fab21dfcee160">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Openid-specs-native-apps mailing list<br>
<a href="mailto:Openid-specs-native-apps@lists.openid.net">Openid-specs-native-apps@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v1/url?u=http://lists.openid.net/mailman/listinfo/openid-specs-native-apps&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=%2BncOwzCBhNISAoJVtNvVMw%3D%3D%0A&m=QMUCjVY9UHNMhU7U8LLSBdCwwjJmrhqydxP2GMraQAU%3D%0A&s=8fc29785f674089a24e266ba0e5178bf5f570735bb1bf418b54fab21dfcee160">http://lists.openid.net/mailman/listinfo/openid-specs-native-apps</a></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</div>
</blockquote></div><br></div></div></body></html>