<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">One step someplace around 4 is the client authenticating to it's backing Web API.<div><br></div><div>For that NAAPS is proposing standardizing a way for the app to request a id_token scoped to it's Backing WebAPI.</div><div>People can then use that in a JWT assertion flow to get a id_token from the AS for the Backing Web API, or directly use the id_token as a access token.</div><div>In that case azp is the client of the app requesting the id_token. (not the NAAPS TA if one is in the flow). </div><div><br></div><div>It sounds like in Caleb's case what he needs is a id_token that the service backing the Web API can use to get a AT for the user_info endpoint. </div><div><br></div><div>A interesting question. </div><div><br></div><div>For security it would be good if the assertion flow also authenticated the backing Web API service to prevent tokens leaking.</div><div><br></div><div>Google currently has a way to ask for this by overloading scopes.</div><div><br></div><div>NAAPS is looking at re using the "aud" parameter on the token_endpoint that the PoP specs define to try and make it clear what the requested "aud" of the id_token should be.</div><div><br></div><div>John B.</div><div><div><div>On Sep 12, 2014, at 12:28 PM, Mike Jones <<a href="mailto:Michael.Jones@microsoft.com">Michael.Jones@microsoft.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Hi all,<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Caleb Baker sent me the following request about how to support native apps with helper Web services. What guidance can we give him and others wanting to implement this scenario? I know that at least Google uses the “azp” claim in ID Tokens as part of supporting this. How exactly is it used in this scenario? How does the OP know when to include an “azp” claim and what value to use?<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">I’m looking for guidance on the use of OpenID Connect by mobile applications that are backed by a Web API. As an example, take a game app that stores the user’s profile, including game state on a back end web service.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">1. The user starts the game app on a new device.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">2. In a web view hosted by the app, they authenticate at their OP and grant permission for the app accessing their profile.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">3. The response is returned to the app<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">4. The app accesses the backing Web API to get the user profile info<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">5. The service backing the Web API is granted access to call the UserInfo endpoint and get additional information about the user<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">6. The app makes additional calls to the Web API to save and retrieve game state each time the app opens and closes.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">I’ve considered using the hybrid flow, with ‘response_ type=code id_token’. Then pass the authorization code to the Web API, so it can access the UserInfo endpoint.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">Using that flow I’m not sure how Web API authorized the app to access the user profile in step 4 and step 6.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">Is there a recommended approach for accomplishing this scenario with OpenID Connect?<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> -- Mike<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div>_______________________________________________<br>Openid-specs-ab mailing list<br><a href="mailto:Openid-specs-ab@lists.openid.net" style="color: purple; text-decoration: underline;">Openid-specs-ab@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-specs-ab" style="color: purple; text-decoration: underline;">http://lists.openid.net/mailman/listinfo/openid-specs-ab</a></div></blockquote></div><br></div></body></html>