Subject: [OAUTH-WG] December 27, 2012 OAuth Release

From: Mike Jones <[email-masked]>
Date: Sat, 29 Dec 2012 01:07:46 +0000

New versions of the OAuth JWT, JWT Bearer Profile, and Assertions specs have been released incorporating feedback since IETF 85 in Atlanta.  The primary change is changing the name of the "prn" claim to "sub" (subject) both to more closely align with SAML name usage and to use a more intuitive name for this concept.  (Also, see the related coordinated change to the OpenID Connect specifications<http://self-issued.info/?p=918>.)  The definition of the "aud" (audience) claim was also extended to allow JWTs to have multiple audiences (a feature also in SAML assertions).

An explanation was added to the JWT spec about why should be signed and then encrypted.

The audience definition in the Assertions specification was relaxed so that audience values can be OAuth "client_id" values.  Informative references to the SAML Bearer Profile and JWT Bearer Profile specs were also added.
This release incorporates editorial improvements suggested by Jeff Hodges, Hannes Tschofenig, and Prateek Mishra in their reviews of the JWT specification.  Many of these simplified the terminology usage.  See the Document History section of each specification for more details about the changes made.

This release is part of a coordinated release of JOSE, OAuth, and OpenID Connect specifications.  You can read about the other releases here:  JOSE Release Notes<http://self-issued.info/?p=913>, OpenID Connect Release Notes<http://self-issued.info/?p=918>.

The new specification versions are:

*        http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06

*        http://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-04

*        http://tools.ietf.org/html/draft-ietf-oauth-assertions-09

HTML formatted versions are available at:

*        http://self-issued.info/docs/draft-ietf-oauth-json-web-token-06.html

*        http://self-issued.info/docs/draft-ietf-oauth-jwt-bearer-04.html

*        http://self-issued.info/docs/draft-ietf-oauth-assertions-09.html

                                                            -- Mike

---

From: William Mills <[email-masked]>
Date: Fri, 28 Dec 2012 18:06:34 -0800 (PST)

Mike,

I've read through the JWT spec and I'm curious about something.  How do I specify a signature requirement as the server?  I didn't see it but I probably just missed it.  I'm thinking that with very little work a JWT can do everything that MAC does with greater flexibility, *BUT* the server needs to be able to require a signed usage.  Something I never liked about OAuth 1.0 is that the server must support all valid signature types, even PLAINTEXT, so I want to be able to avoid that.

It would require the client to be able to include client generated stuff in the JWT.

Thanks,

-bill

---

From: Dick Hardt <[email-masked]>
Date: Fri, 28 Dec 2012 20:10:44 -0800

Looks like I was not the only one that was reading "p0rn" when I saw "prn" … ;-)

On Dec 28, 2012, at 5:07 PM, Mike Jones <[email-masked]> wrote:

> New versions of the OAuth JWT, JWT Bearer Profile, and Assertions specs have been released incorporating feedback since IETF 85 in Atlanta.  The primary change is changing the name of the “prn” claim to “sub” (subject) both to more closely align with SAML name usage and to use a more intuitive name for this concept.  (Also, see the related coordinated change to the OpenID Connect specifications.)  The definition of the “aud” (audience) claim was also extended to allow JWTs to have multiple audiences (a feature also in SAML assertions).
>  
> The audience definition in the Assertions specification was relaxed so that audience values can be OAuth “client_id” values.  Informative references to the SAML Bearer Profile and JWT Bearer Profile specs were also added.
> This release is part of a coordinated release of JOSE, OAuth, and OpenID Connect specifications.  You can read about the other releases here:  JOSE Release Notes, OpenID Connect Release Notes.
>  
> ·        http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06
> ·        http://tools.ietf.org/html/draft-ietf-oauth-jwt-bearer-04
> ·        http://tools.ietf.org/html/draft-ietf-oauth-assertions-09
>  
> ·        http://self-issued.info/docs/draft-ietf-oauth-json-web-token-06.html
> ·        http://self-issued.info/docs/draft-ietf-oauth-jwt-bearer-04.html
> ·        http://self-issued.info/docs/draft-ietf-oauth-assertions-09.html
>  
>                                                             -- Mike
>  
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth