Subject: [OAUTH-WG] Proposed additions to clarify authz and/or authn usage with assertions

From: Brian Campbell <[email-masked]>
Date: Wed, 12 Sep 2012 13:58:14 -0600

WG,

Here is my long overdue proposal to address questions/comments raised
in http://www.ietf.org/mail-archive/web/oauth/current/msg09512.html
indicating there was some potential confusion about the orthogonally
and separability of client assertion authentication and assertion
grants.

Each of draft-ietf-oauth-assertions, draft-ietf-oauth-saml2-bearer and
draft-ietf-oauth-jwt-bearer have brief language in the introduction
that says that authentication and authorization are orthogonal and
that can be used together or separately. I'd like to update that text
in SAML and JWT to match the recent edit made in -05 of
draft-ietf-oauth-assertions and add the following (with small
variations to match context) to it in each document:

"Client assertion authentication is nothing more than an alternative
way for a client to authenticate to the token endpoint and must be
used in conjunction with some grant type to form a complete and
meaningful protocol request. Assertion authorization grants may be
used with or without client authentication or identification. Whether
or not client authentication is needed in conjunction with an
assertion authorization grant, as well as the supported types of
client authentication, are a policy decisions at the discretion of the
authorization server."

I'd also like to include two new examples in
draft-ietf-oauth-saml2-bearer and draft-ietf-oauth-jwt-bearer that
show access token requests using a token/assertion as a grant type and
as client authentication respectively.

I went ahead an produced preliminary drafts of each of the documents
with the changes mentioned herein. Text versions along with the XML
source of those are attached. Comments, questions and corrections are
welcome as always. But barring any objection, I'd like to proceed with
publishing new drafts containing these changes relatively soon.

Thanks,
Brian

---

From: Brian Campbell <[email-masked]>
Date: Wed, 12 Sep 2012 15:30:58 -0600

I meant to say that there would be two new examples in each of
draft-ietf-oauth-saml2-bearer and draft-ietf-oauth-jwt-bearer. Sorry,
the way I said it before was kind of misleading.

---

From: Mike Jones <[email-masked]>
Date: Wed, 12 Sep 2012 22:48:51 +0000

Thanks for doing this Brian.  I believe that your changes help clarify the intent of the drafts and would like to see them published.

I've applied a few editorial corrections to your drafts and attached the results, including the output .txt, .html, and .pdf versions.  If you agree with my corrections, these should be ready to post.

				Thanks again,
				-- Mike

-----Original Message-----
From: Brian Campbell [mailto:[email-masked]] 
Sent: Wednesday, September 12, 2012 2:31 PM
To: oauth
Cc: Chuck Mortimore; Mike Jones; Yaron Goland
Subject: Re: Proposed additions to clarify authz and/or authn usage with assertions

I meant to say that there would be two new examples in each of draft-ietf-oauth-saml2-bearer and draft-ietf-oauth-jwt-bearer. Sorry, the way I said it before was kind of misleading.

---

From: Willem van Engen <[email-masked]>
Date: Thu, 13 Sep 2012 12:26:26 +0200

> client authentication, are a policy decisions at the discretion of the
The last sentence appears to leave some space for client assertion 
authentication to be used with other forms of client authentication. Is 
this intended, as it appears to go contrary to "The client MUST NOT use 
more than one authentication method in each request" in [1] ?

Regards,
- Willem

[1] http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-2.3

---

From: Brian Campbell <[email-masked]>
Date: Thu, 13 Sep 2012 10:09:58 -0600

The last sentence is intended to say that any form of client
authentication that the AS supports (including none) can be used with
an assertion grant. It's a general policy statement and doesn't mean
that more than one type of client authentication can be used in a
single request. That "The client MUST NOT use more than one
authentication method in each request" and other requirements from
draft-ietf-oauth-v2 still apply.

Could this be worded differently to be more clear?

On Thu, Sep 13, 2012 at 4:26 AM, Willem van Engen
<[email-masked]> wrote:
> authentication to be used with other forms of client authentication. Is this
> intended, as it appears to go contrary to "The client MUST NOT use more than
> one authentication method in each request" in [1] ?
>
> Regards,
> - Willem
>