Subject: [OAUTH-WG] Must the Audience value in the Assertions Spec be a URI?

From: Mike Jones <[email-masked]>
Date: Thu, 27 Dec 2012 01:43:08 +0000

http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-5.1 currently says:

   Audience  A URI that identifies the party intended to process the

      assertion.  The audience SHOULD be the URL of the Token Endpoint

      as defined in Section 3.2<http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-3.2> of OAuth 2.0 [RFC6749<http://tools.ietf.org/html/rfc6749>].

I think that "URI" should be changed to "value", since audience values in general need not be URIs.  In particular, in some contexts OAuth client_id values are used as audience values, and they need not be URIs.  Also, SAML allows multiple audiences (and indeed, the OAuth SAML profile is written in terms of "an audience value" - not "the audience value"), and so the generic Assertions spec should do likewise.

Thus, I would propose changing the text above to the following:

   Audience  A value that identifies the parties intended to process the

      assertion.  An audience value SHOULD be the URL of the Token Endpoint

      as defined in Section 3.2<http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-3.2> of OAuth 2.0 [RFC6749<http://tools.ietf.org/html/rfc6749>].

                                                            -- Mike

---

From: Torsten Lodderstedt <[email-masked]>
Date: Thu, 27 Dec 2012 07:46:10 +0100

+1 

Am 27.12.2012 um 02:43 schrieb Mike Jones <[email-masked]>:

>       as defined in Section 3.2 of OAuth 2.0 [RFC6749].
>  
> I think that “URI” should be changed to “value”, since audience values in general need not be URIs.  In particular, in some contexts OAuth client_id values are used as audience values, and they need not be URIs.  Also, SAML allows multiple audiences (and indeed, the OAuth SAML profile is written in terms of “an audience value” – not “the audience value”), and so the generic Assertions spec should do likewise.
>  
>       as defined in Section 3.2 of OAuth 2.0 [RFC6749].
>  
>                                                             -- Mike
>  
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Thu, 27 Dec 2012 10:31:40 -0300

Agreed.

We need to clarify that the value of the audience claim can be multi valued as well. 

John B.

---

From: Brian Campbell <[email-masked]>
Date: Thu, 27 Dec 2012 09:52:25 -0700

I agree that “URI” should be changed to “value” for audience in the
Assertions Spec (draft-ietf-oauth-assertions) as well as the JWT
incarnation of it (draft-ietf-oauth-jwt-bearer).  The SAML incarnation
(draft-ietf-oauth-saml2-bearer) should probably keep URI because that's how
the core SAML specification (saml-core-2.0-os) defines audience.

On Wed, Dec 26, 2012 at 6:43 PM, Mike Jones <[email-masked]>wrote:

>  http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-5.1currently says:
> ****
>
> ** **
>
>    Audience  A URI that identifies the party intended to process the****
>
>       assertion.  The audience SHOULD be the URL of the Token Endpoint****
>
>       as defined in Section 3.2 <http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-3.2> of OAuth 2.0 [RFC6749 <http://tools.ietf.org/html/rfc6749>].****
>
> ** **
>
> I think that “URI” should be changed to “value”, since audience values in
> general need not be URIs.  In particular, in some contexts OAuth client_id
> values are used as audience values, and they need not be URIs.  Also, SAML
> allows multiple audiences (and indeed, the OAuth SAML profile is written in
> terms of “an audience value” – not “the audience value”), and so the
> generic Assertions spec should do likewise.****
>
> ** **
>
> Thus, I would propose changing the text above to the following:****
>
> ** **
>
>    Audience  A value that identifies the parties intended to process the****
>
>       assertion.  An audience value SHOULD be the URL of the Token Endpoint****
>
>       as defined in Section 3.2 <http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-3.2> of OAuth 2.0 [RFC6749 <http://tools.ietf.org/html/rfc6749>].****
>
>  ** **
>
>                                                             -- Mike****
>
> ** **
>

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 27 Dec 2012 22:55:58 +0000

Concern here is that value could be an “interpretation” and thus you may get different results that you don’t get when it’s a URI

From: [email-masked] [mailto:[email-masked]] On Behalf Of Torsten Lodderstedt
Sent: Wednesday, December 26, 2012 10:46 PM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Must the Audience value in the Assertions Spec be a URI?

+1

Am 27.12.2012 um 02:43 schrieb Mike Jones <[email-masked]<mailto:[email-masked]>>:
http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-5.1 currently says:

                                                            -- Mike

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 27 Dec 2012 22:57:09 +0000

What do you mean by multi-valued and what are the semantics of multi-vale ?

From: [email-masked] [mailto:[email-masked]] On Behalf Of John Bradley
Sent: Thursday, December 27, 2012 5:32 AM
To: Mike Jones
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Must the Audience value in the Assertions Spec be a URI?

Agreed.

John B.

On 2012-12-26, at 10:43 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:

                                                            -- Mike

---

From: John Bradley <[email-masked]>
Date: Thu, 27 Dec 2012 21:53:41 -0300

The discussion on the Connect call was that audience could be a literal or an array.

example

"aud":["http://audiance1.com","http://audiance2.com"]

In some cases the token may want to have more than a single audience.  
(anthropomorphic license)

in the simple case it would still be
"aud":"http://audiance1.com"

While dynamic typing of variables is not my favourite thing in principal, I am assured that this is common JSON syntax that people can deal with.

The idea is to standardize this rather than everyone coming up with their own way around the restriction as google did by adding the prn claim.

At least this way if you only trust tokens with yourself as the audience you have a easy way to check.

John B.

---

From: Brian Campbell <[email-masked]>
Date: Fri, 28 Dec 2012 06:59:24 -0700

I believe John meant to refer to Google's adding of the *cid* claim rather
than the *prn* claim.

On Thu, Dec 27, 2012 at 5:53 PM, John Bradley <[email-masked]> wrote:

> While dynamic typing of variables is not my favourite thing in principal,
> I am assured that this is common JSON syntax that people can deal with.
>
> The idea is to standardize this rather than everyone coming up with their
> own way around the restriction as google did by adding the prn claim.
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *John Bradley
> *Sent:* Thursday, December 27, 2012 5:32 AM
> *To:* Mike Jones
> *Cc:* [email-masked]
> *Subject:* Re: [OAUTH-WG] Must the Audience value in the Assertions Spec
> be a URI?****
> ** **
> Agreed.****
> ** **
> We need to clarify that the value of the audience claim can be multi
> valued as well. ****
> ** **
> John B.****
> ** **
> On 2012-12-26, at 10:43 PM, Mike Jones <[email-masked]>
> wrote:****
>
>
> ****
>
> http://tools.ietf.org/html/draft-ietf-oauth-assertions-08#section-5.1 currently
> says:****
>  ****
>
> https://www.ietf.org/mailman/listinfo/oauth****
>
>
>

---

From: John Bradley <[email-masked]>
Date: Fri, 28 Dec 2012 11:30:01 -0300

Sorry yes, Google calls it cid.   Mike's TLA theory for JWT, JWE, JWS , JWK can be confusing at times.

On 2012-12-28, at 10:59 AM, Brian Campbell <[email-masked]> wrote:

> I believe John meant to refer to Google's adding of the cid claim rather than the prn claim.
> 
>