Subject: [OAUTH-WG] FW: I-D Action:draft-oauth-dyn-reg-v1-02.txt

From: Thomas Hardjono <[email-masked]>
Date: Mon, 2 May 2011 13:04:31 -0400

FYI Folks,

This is an update of the Dynamic Client Registration Protocol draft. The previous version (draft-01) expired in Feb.

Thanks.

/thomas/

________________________________

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Monday, May 02, 2011 12:00 PM
To: [email-masked]
Subject: I-D Action:draft-oauth-dyn-reg-v1-02.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : OAuth Dynamic Client Registration Protocol
        Author(s)       : T. Hardjono, et al.
        Filename        : draft-oauth-dyn-reg-v1-02.txt
        Pages           : 20
        Date            : 2011-05-02

This specification proposes an OAuth Dynamic Client Registration protocol.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-oauth-dyn-reg-v1-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft.
Q29udGVudC1UeXBlOiB0ZXh0L3BsYWluDQpDb250ZW50LUlEOiA8MjAxMS0wNS0wMjA4NTU1NC5J
LURAaWV0Zi5vcmc+DQoNCg==

---

From: "Manger, James H" <[email-masked]>
Date: Wed, 4 May 2011 12:51:28 +1000

Comments on the OAuth Dynamic Client Registration Protocol [draft-oauth-dyn-reg-v1-02]:

I found it hard to gleam from this draft where any trust in the client information being registered comes from. Sources could be: self-asserted; PKI with well-known roots; or DNS.

OpenID and WebID are two existing approaches for authenticating to a server you have never met before. A client logging in to an authorization server (AS) using one of these techniques then accessing a specific page could be treated as a registration.
[A variant of OpenID suitable for apps, as opposed to users, is sorely needed.]

Section 6: "Client Registration with Pushed Metadata"
The draft talks about an authorization server "verifying information received from the client" [6.2] but with no clues as to what is verified or how. Checks that client_name doesn't contain control characters, client_uri is syntactically correct, or that client_uri returns "200 OK" and text/html content are possible, but almost meaningless. They don't tell the AS that the values are appropriate for the client that it is talking to.

Section 7: " Client Registration with Pushed URL and Pulled Metadata"
Pushing a URL appears insecure. A malicious app POSTs another apps client_url (7.1) and gets a client_id and client_secret for that app in return. Perhaps signing the POSTed client_url helps (the draft says a client MAY do this), but it isn't obvious to me how the AS checks the signer is the right entity. Must the same certificate (or same key, or same cert subject...) be used to sign the POST and to serve the metadata the AS subsequently gets from https://.../.well-known/host-meta?

Section 6.2: "Client Registration Response" [and 6.3 and 7.3 and 7.4]
This looks like another version of an OAuth2 token response [draft-ietf-oauth-v2-15#section-5.1]. It conveys similar data (dynamically-issued credentials), but makes up another format. It doesn't tell the client how or where to use the credentials (ie which authentication mechanisms, and which servers).

This draft and OAuth2 would be helped if we defined an explicit media type for credentials: eg application/credentials+json. This draft could use it to return client credentials. OAuth2 could use it to return credentials representing a user's delegation to a client etc. It could cover the common needs: id, auth mechanism, where it is safe to use, lifetime, renewal, multiple credentials, errors....

--
James Manger

---

From: Thomas Hardjono <[email-masked]>
Date: Wed, 4 May 2011 10:34:19 -0400

FYI folks,

I renamed the draft to draft-hardjono-oauth-dynreg-00.txt for consistency with IETF naming of drafts.

/thomas/

_________________________

	Title           : OAuth Dynamic Client Registration Protocol
	Author(s)       : T. Hardjono, et al.
	Filename        : draft-hardjono-oauth-dynreg-00.txt
	Pages           : 20
	Date            : 2011-05-03

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-hardjono-oauth-dynreg-00.txt

Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft

__________________________________________

> From: Thomas Hardjono
> Sent: Monday, May 02, 2011 1:05 PM
> To: oauth ([email-masked])
> Cc: Thomas Hardjono
> Subject: FW: I-D Action:draft-oauth-dyn-reg-v1-02.txt
> 
> FYI Folks,
> 
> This is an update of the Dynamic Client Registration Protocol draft.
> The previous version (draft-01) expired in Feb.
> 
> Thanks.
> 
> /thomas/
> 
> From: [email-masked] [mailto:i-d-announce-
> [email-masked]] On Behalf Of [email-masked]
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.