Subject: Re: [OAUTH-WG] Multiple authorization servers for one resource server

From: Mike Schwartz <[email-masked]>
Date: Sat, 12 Mar 2016 10:32:17 -0600

Kawasaki-san,

This is a really good question: how to know the issuer of a bearer 
token. Is there a header that could be added to specify the issuer, or 
other important metadata?

- Mike

-------------------------------------
Michael Schwartz
Gluu
Founder / CEO
[email-masked]

---

From: Jim Willeke <[email-masked]>
Date: Sat, 12 Mar 2016 09:02:47 -0800

Why not register JWT as an access token type
<https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-types>
and then the the Issuer is implied?

--
-jim
Jim Willeke

On Sat, Mar 12, 2016 at 8:32 AM, Mike Schwartz <[email-masked]> wrote:

> Kawasaki-san,
>
> This is a really good question: how to know the issuer of a bearer token.
> Is there a header that could be added to specify the issuer, or other
> important metadata?
>
> - Mike
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Sat, 12 Mar 2016 10:03:30 -0800

A header might open another attack vector. Better to parse the jwt and look for the issuer assuming the jwt validates. 

Phil

> On Mar 12, 2016, at 09:02, Jim Willeke <[email-masked]> wrote:
> 
> Why not register JWT as an access token type and then the the Issuer is implied?
> 
> --
> -jim
> Jim Willeke
> 
>> This is a really good question: how to know the issuer of a bearer token. Is there a header that could be added to specify the issuer, or other important metadata?
>> 
>> - Mike
>> 
>>

---

From: Jim Willeke <[email-masked]>
Date: Sat, 12 Mar 2016 11:29:47 -0800

Would a header be a concern if TLS was used for transportation?

--
-jim
Jim Willeke

On Sat, Mar 12, 2016 at 10:03 AM, Phil Hunt (IDM) <[email-masked]>
wrote:

> A header might open another attack vector. Better to parse the jwt and
> look for the issuer assuming the jwt validates.
>
> Phil
>

---

From: "Phil Hunt (IDM)" <[email-masked]>
Date: Sat, 12 Mar 2016 11:36:56 -0800

Right now we are discussing mis-configured clients that have been convinced to use a token or rs endpoint that has been mitm. Adding a new parameter increases attack surface because the rs is now ignoring the token abd believing the header which may have been inserted. 

Phil

> On Mar 12, 2016, at 11:29, Jim Willeke <[email-masked]> wrote:
> 
>> On Sat, Mar 12, 2016 at 10:03 AM, Phil Hunt (IDM) <[email-masked]> wrote:

---

From: Justin Richer <[email-masked]>
Date: Sat, 12 Mar 2016 20:04:23 -0500

Agree with Phil, an additional header is a bad idea. It's not only yet 
another thing that can be attacked, it's another thing that can get out 
of sync by the client. Always assume OAuth clients are the dumbest parts 
of the system.

  -- Justin

On 3/12/2016 2:36 PM, Phil Hunt (IDM) wrote:
> Right now we are discussing mis-configured clients that have been 
> convinced to use a token or rs endpoint that has been mitm. Adding a 
> new parameter increases attack surface because the rs is now ignoring 
> the token abd believing the header which may have been inserted.
>
> Phil
>
> On Mar 12, 2016, at 11:29, Jim Willeke <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>> On Sat, Mar 12, 2016 at 10:03 AM, Phil Hunt (IDM) 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     A header might open another attack vector. Better to parse the
>>     jwt and look for the issuer assuming the jwt validates.
>>
>>     Phil
>>
>>     On Mar 12, 2016, at 09:02, Jim Willeke <[email-masked]
>>     <mailto:[email-masked]>> wrote:
>>
>>>     Why not register JWT as anaccess token type
>>>     On Sat, Mar 12, 2016 at 8:32 AM, Mike Schwartz <[email-masked]
>>>     <mailto:[email-masked]>> wrote:
>>>
>>>         Kawasaki-san,
>>>
>>>         This is a really good question: how to know the issuer of a
>>>         bearer token. Is there a header that could be added to
>>>         specify the issuer, or other important metadata?
>>>
>>>         - Mike
>>>
>>>
>>>         [email-masked] <mailto:[email-masked]>
>>>
>>>         [email-masked] <mailto:[email-masked]>
>>>     [email-masked] <mailto:[email-masked]>
>> [email-masked] <mailto:[email-masked]>

---

From: Nat Sakimura <[email-masked]>
Date: Sun, 13 Mar 2016 12:43:27 +0000

The question is about how RS can find the issuer from a bearer token that
it received from the client. Obviously, a header from the AS does not work.
We would have to have some kind of structured token. It can be a JWS or
something proprietary to the trust framework.

Note: the client is untrusted and forms an unprotected segment. You would
have to treat the client as the smartest, in a bad way.
2016年3月13日(日) 10:04 Justin Richer <[email-masked]>:

> another thing that can be attacked, it's another thing that can get out of
> sync by the client. Always assume OAuth clients are the dumbest parts of
> the system.
>
>
>  -- Justin
>
>
> convinced to use a token or rs endpoint that has been mitm. Adding a new
> parameter increases attack surface because the rs is now ignoring the token
> abd believing the header which may have been inserted.
>
> Phil
>
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>