Subject: [OAUTH-WG] Question related to OAuth access token

From: Security Developer <[email-masked]>
Date: Fri, 16 Nov 2012 01:03:16 +0500

Hi,

If an access token is either SAML or JWT in OAuth then what would be the
value in subject either resource owner or client application name?

Thanks for your time.

Regards,

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 19 Nov 2012 09:40:48 +0200

Hi "Security Developer" ;-)

the JWT specification can be found at http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-05. The resource owner's identifier goes into the <prn> claim. Information about the client identifier is not carried in a standardized format inside the JWT. 

We have not standardized a SAML-based access token format in the OAuth working group. So, there is no information available about that. 

I hope this answers your question. 

Ciao
Hannes

On Nov 15, 2012, at 10:03 PM, Security Developer wrote:

> Hi,
> 
> If an access token is either SAML or JWT in OAuth then what would be the value in subject either resource owner or client application name?
> 
> Thanks for your time.
> 
> Regards,
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 24 Nov 2012 19:17:52 +0100

Hi,

both options are viable. It depends on the purpose the token is used for 
in a particular deployment, esp. whether it carries the data about the 
resource and it owner or whether it merely represents the authorization 
of the particular client.

regards,
Torsten.

Am 15.11.2012 21:03, schrieb Security Developer:
> Hi,
>
> If an access token is either SAML or JWT in OAuth then what would be 
> the value in subject either resource owner or client application name?
>
> Thanks for your time.
>
> Regards,
>
>