Subject: [OAUTH-WG] Registration: JWK Urls

From: Justin Richer <[email-masked]>
Date: Tue, 26 Feb 2013 10:05:23 -0500

Right now, the Dynamic Registration draft has four URLs that deal with 
registering public keys for the client:

jwk_uri
jwk_encryption_uri
x509_uri
x509_encryption_uri

These are for use in things like JWK-based assertions for client 
authentication and signing/encryption with higher-level protocols.

Recent and impending changes in the JWK specification allow it to 
specify what a given key can be used for, and provide different formats 
for the keys including an x509 encoded certificate. These changes seem 
to get rid of the need for specifying for separate URLs for each format 
and function in registration.

It's been proposed, from the OIDC working group, to collapse all of 
these into a single, new parameter:

jwks_uri

Which would point specifically to a "JWK Set" as defined in the JWK draft.

I'm in favor of this simplifying change, and OIDC has already adopted it 
on their end. Thoughts?

  -- Justin

---

From: Brian Campbell <[email-masked]>
Date: Tue, 26 Feb 2013 08:11:05 -0700

+1

On Tue, Feb 26, 2013 at 8:05 AM, Justin Richer <[email-masked]> wrote:

> Recent and impending changes in the JWK specification allow it to specify
> what a given key can be used for, and provide different formats for the
> keys including an x509 encoded certificate. These changes seem to get rid
> of the need for specifying for separate URLs for each format and function
> in registration.
>
> It's been proposed, from the OIDC working group, to collapse all of these
> into a single, new parameter:
>
> jwks_uri
>
> ______________________________**_________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/oauth<https://www.ietf.org/mailman/listinfo/oauth>
>

---

From: John Bradley <[email-masked]>
Date: Tue, 26 Feb 2013 07:23:15 -0800

One of the goals on the JWK side was to be able to simplify it.

I support the change.

John B.
On 2013-02-26, at 7:05 AM, Justin Richer <[email-masked]> wrote:

> Right now, the Dynamic Registration draft has four URLs that deal with registering public keys for the client:
> 
> jwk_uri
> jwk_encryption_uri
> x509_uri
> x509_encryption_uri
> 
> These are for use in things like JWK-based assertions for client authentication and signing/encryption with higher-level protocols.
> 
> Recent and impending changes in the JWK specification allow it to specify what a given key can be used for, and provide different formats for the keys including an x509 encoded certificate. These changes seem to get rid of the need for specifying for separate URLs for each format and function in registration.
> 
> It's been proposed, from the OIDC working group, to collapse all of these into a single, new parameter:
> 
> jwks_uri
> 
> I'm in favor of this simplifying change, and OIDC has already adopted it on their end. Thoughts?
> 
> -- Justin
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth