Subject: [core] Question about RD from ACE

From: Ludwig Seitz <[email-masked]>
Date: Mon, 23 Oct 2017 15:34:24 +0200

Hello CoRE,

an interesting question has come up in ACE, for which we would need 
feed-back from people familiar with the Resource Directory work.

In our draft we suggest that a client that whishes to access a resource 
at a server can look up the authorization server in charge of that 
server in a resource directory [1]. Jim Schaad has made me aware that 
this is not as easy as it sounds [2], and I feel I would need feed-back 
as to:

1.) Is it a good idea at all to put such information somewhere in the RD?

2.) Where in the RD would one put such information? What would such a 
resource type look like?

Regards,

Ludwig Seitz

[1] https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-08#section-5.1
[2] https://github.com/ace-wg/ace-oauth/issues/120
-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone +46(0)70-349 92 51

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 23 Oct 2017 15:41:18 +0200

On Oct 23, 2017, at 15:34, Ludwig Seitz <[email-masked]> wrote:
> 
> Hello CoRE,
> 
> an interesting question has come up in ACE, for which we would need feed-back from people familiar with the Resource Directory work.
> 
> In our draft we suggest that a client that whishes to access a resource at a server can look up the authorization server in charge of that server in a resource directory [1].

That appears to be the wrong way around.

A client that finds a resource in a resource directory might find link relations or target attributes there that will also find the authorization manager for that server.

> Jim Schaad has made me aware that this is not as easy as it sounds [2], and I feel I would need feed-back as to:
> 

Yes.  We haven’t really discussed how the authorization of the disclosure of such information would work in an RD, but that should be a relatively small step with ACE available.

> 2.) Where in the RD would one put such information? What would such a resource type look like?

Say,

<coaps://security.example.com/as>;rel=authorization-managed-by;anchor=“/s/temp”;ace-profile=“oscore"

(Add target attributes to get more useful profile information in there; the above surely doesn’t cut it.)

Grüße, Carsten