Subject: Re: [OAUTH-WG] JWT grant_type and client_id

From: Lewis Adam-CAL022 <[email-masked]>
Date: Thu, 14 Mar 2013 21:26:30 +0000

Coming back to this ... am I correct in that client_id is not required?  We are implementing this spec and want to make sure that we are doing it right.  By my understanding the only two parameters that are required in the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"  and the assertion.   Is this correct?

From: Mike Jones [mailto:[email-masked]]
Sent: Monday, February 18, 2013 6:58 PM
To: Lewis Adam-CAL022; [email-masked] WG
Subject: RE: JWT grant_type and client_id

The client_id value and the access token value are independent.

                                                                -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Lewis Adam-CAL022
Sent: Monday, February 18, 2013 2:50 PM
To: [email-masked] WG
Subject: [OAUTH-WG] JWT grant_type and client_id

Is there any guidance on the usage of client_id when using the JWT assertion profile as a grant type?  draft-ietf-oauth-jwt-bearer-04 makes no mention so I assume that it is not required ... but it would be necessary if using in conjunction with a HOK profile where the JWT assertion is issued to - and may only be used by - the intended client.  Obviously this is straight forward enough, really I'm just looking to be sure that I'm not missing anything.

tx
adam

---

From: Brian Campbell <[email-masked]>
Date: Thu, 14 Mar 2013 17:43:41 -0400

Yes, that is correct.

I'm working on new revisions of the drafts that will hopefully make that
point more clear.

On Thu, Mar 14, 2013 at 5:26 PM, Lewis Adam-CAL022 <
[email-masked]> wrote:

>  Coming back to this … am I correct in that client_id is not required?  We are implementing this spec and want to make sure that we are doing it right.  By my understanding the only two parameters that are required in the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"  and the assertion.   Is this correct?****
>
> ** **
>
> ** **
>
> *From:* Mike Jones [mailto:[email-masked]]
> *Sent:* Monday, February 18, 2013 6:58 PM
> *To:* Lewis Adam-CAL022; [email-masked] WG
> *Subject:* RE: JWT grant_type and client_id****
>
> ** **
>
> The client_id value and the access token value are independent.****
>
> ** **
>
>                                                                 -- Mike***
> *
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Lewis Adam-CAL022
> *Sent:* Monday, February 18, 2013 2:50 PM
> *To:* [email-masked] WG
> *Subject:* [OAUTH-WG] JWT grant_type and client_id****
>
> ** **
>
> ** **
>
> Is there any guidance on the usage of client_id when using the JWT
> assertion profile as a grant type?  draft-ietf-oauth-jwt-bearer-04 makes no
> mention so I assume that it is not required … but it would be necessary if
> using in conjunction with a HOK profile where the JWT assertion is issued
> to – and may only be used by – the intended client.  Obviously this is
> straight forward enough, really I’m just looking to be sure that I’m not
> missing anything.****
>
> ** **
>
> tx****
>
> adam****
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Fri, 15 Mar 2013 00:47:06 +0000

Hmmm, one more thought ... no scope??  The JWT is the grant, is it assumed that the scope is conveyed as a claim within the token?  Otherwise it would seem that it would require a scope.

Thoughts?
adam

From: Brian Campbell [mailto:[email-masked]]
Sent: Thursday, March 14, 2013 4:44 PM
To: Lewis Adam-CAL022
Cc: Mike Jones; "WG <[email-masked]>"@il06exr02.mot.com
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Yes, that is correct.
I'm working on new revisions of the drafts that will hopefully make that point more clear.

On Thu, Mar 14, 2013 at 5:26 PM, Lewis Adam-CAL022 <[email-masked]<mailto:[email-masked]>> wrote:

From: Mike Jones [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Monday, February 18, 2013 6:58 PM
To: Lewis Adam-CAL022; [email-masked]<mailto:[email-masked]> WG
Subject: RE: JWT grant_type and client_id

                                                                -- Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Lewis Adam-CAL022
Sent: Monday, February 18, 2013 2:50 PM
To: [email-masked]<mailto:[email-masked]> WG
Subject: [OAUTH-WG] JWT grant_type and client_id

tx
adam

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Fri, 15 Mar 2013 13:09:31 -0400

The spec is a touch vague on that.  I think the scopes should be in the assertion and the client can use the scopes outside the assertion to down-scope.

Having a standard claim in JWT and SAML for passing scopes is probably useful as part of a profile.

John B.

On 2013-03-14, at 8:47 PM, Lewis Adam-CAL022 <[email-masked]> wrote:

> Hmmm, one more thought … no scope??  The JWT is the grant, is it assumed that the scope is conveyed as a claim within the token?  Otherwise it would seem that it would require a scope.
>  
> Thoughts?
> adam
>  
> On Thu, Mar 14, 2013 at 5:26 PM, Lewis Adam-CAL022 <[email-masked]> wrote:
> Coming back to this … am I correct in that client_id is not required?  We are implementing this spec and want to make sure that we are doing it right.  By my understanding the only two parameters that are required in the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"  and the assertion.   Is this correct?
>  
>  
> Is there any guidance on the usage of client_id when using the JWT assertion profile as a grant type?  draft-ietf-oauth-jwt-bearer-04 makes no mention so I assume that it is not required … but it would be necessary if using in conjunction with a HOK profile where the JWT assertion is issued to – and may only be used by – the intended client.  Obviously this is straight forward enough, really I’m just looking to be sure that I’m not missing anything.
>  
> tx
> adam
>

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Fri, 15 Mar 2013 20:40:15 +0000

Hi John,

I would like to argue that the scope should be a parameter in the access token request message, the same as it is for the RO creds grant and client creds grant type.  This would keep it consistent with the core OAuth grant types that talk directly to the token endpoint.

Thoughts?
adam

From: John Bradley [mailto:[email-masked]]
Sent: Friday, March 15, 2013 12:10 PM
To: Lewis Adam-CAL022
Cc: Brian Campbell; "WG <[email-masked]>"@il06exr02.mot.com
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

John B.

On 2013-03-14, at 8:47 PM, Lewis Adam-CAL022 <[email-masked]<mailto:[email-masked]>> wrote:

Thoughts?
adam

From: Brian Campbell [mailto:[email-masked]<http://pingidentity.com>]
Sent: Thursday, March 14, 2013 4:44 PM
To: Lewis Adam-CAL022
Cc: Mike Jones; "WG <[email-masked]<mailto:[email-masked]>>"@il06exr02.mot.com<http://il06exr02.mot.com>
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Yes, that is correct.

                                                                -- Mike

tx
adam

---

From: Sergey Beryozkin <[email-masked]>
Date: Fri, 15 Mar 2013 21:31:12 +0000

Hi
On 15/03/13 20:40, Lewis Adam-CAL022 wrote:
> Hi John,
>
> I would like to argue that the scope should be a parameter in the access
> token request message, the same as it is for the RO creds grant and
> client creds grant type. This would keep it consistent with the core
> OAuth grant types that talk directly to the token endpoint.
>
Assuming the assertion is acting as a grant, then it is indeed an access 
token request message, so IMHO it makes sense to get an outbound scope 
parameter optionally supported which I guess will imply that the client 
id will also have to accompany it...

Cheers, Sergey

> Thoughts?
>
> adam
>
> *From:*John Bradley [mailto:[email-masked]]
> *Sent:* Friday, March 15, 2013 12:10 PM
> *To:* Lewis Adam-CAL022
> *Cc:* Brian Campbell; "WG <[email-masked]>"@il06exr02.mot.com
> *Subject:* Re: [OAUTH-WG] JWT grant_type and client_id
>
> The spec is a touch vague on that. I think the scopes should be in the
> assertion and the client can use the scopes outside the assertion to
> down-scope.
>
> On 2013-03-14, at 8:47 PM, Lewis Adam-CAL022
> <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>
>
> Hmmm, one more thought … no scope?? The JWT is the grant, is it assumed
> that the scope is conveyed as a claim within the token? Otherwise it
> would seem that it would require a scope.
>
> Thoughts?
>
> adam
>
> *From:*Brian Campbell [mailto:[email-masked]
> <http://pingidentity.com>]
> *Sent:*Thursday, March 14, 2013 4:44 PM
> *To:*Lewis Adam-CAL022
> *Cc:*Mike Jones; "WG <[email-masked]
> <mailto:[email-masked]>>"@il06exr02.mot.com <http://il06exr02.mot.com>
> *Subject:*Re: [OAUTH-WG] JWT grant_type and client_id
>
> Yes, that is correct.
>
> On Thu, Mar 14, 2013 at 5:26 PM, Lewis Adam-CAL022
> <[email-masked]
> <mailto:[email-masked]>> wrote:
>
> Coming back to this…  am I correct in that client_id is not required?    We are implementing this spec and want to make sure that we are doing it right.    By my understanding the only two parameters that are required in the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"    and the assertion.      Is this correct?
>
> *From:*Mike Jones [mailto:[email-masked]
> <mailto:[email-masked]>]
> *Sent:*Monday, February 18, 2013 6:58 PM
> *To:*Lewis Adam-CAL022;[email-masked] <mailto:[email-masked]>WG
> *Subject:*RE: JWT grant_type and client_id
>
> *From:[email-masked]
> <mailto:[email-masked]>[mailto:[email-masked]
> <mailto:[email-masked]>]*On Behalf Of*Lewis Adam-CAL022
> *Sent:*Monday, February 18, 2013 2:50 PM
> *To:[email-masked] <mailto:[email-masked]>WG
> *Subject:*[OAUTH-WG] JWT grant_type and client_id
>
> assertion profile as a grant type? draft-ietf-oauth-jwt-bearer-04 makes
> no mention so I assume that it is not required … but it would be
> necessary if using in conjunction with a HOK profile where the JWT
> assertion is issued to – and may only be used by – the intended client.
> Obviously this is straight forward enough, really I’m just looking to be
> sure that I’m not missing anything.
>
> tx
>
> adam
>
>
> [email-masked] <mailto:[email-masked]>
> [email-masked] <mailto:[email-masked]>

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Fri, 15 Mar 2013 21:43:55 +0000

Right ... thinking about this further I think the answer is "all of the above."  If the JWT is a grant type then as you say it needs a scope param and optionally a client_id param.  I argued for the client_id param earlier since it could assist with HOK scenarios once those further develop.

But when the JWT is used as an AT then it will definitely require the scope as a claim.

So I change my argument to "both" :)

adam

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sergey Beryozkin
Sent: Friday, March 15, 2013 4:31 PM
To: [email-masked]
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Hi

Cheers, Sergey

> Hmmm, one more thought ... no scope?? The JWT is the grant, is it assumed
> Coming back to this...  am I correct in that client_id is not required?    We are implementing this spec and want to make sure that we are doing it right.    By my understanding the only two parameters that are required in the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"    and the assertion.      Is this correct?
>
> no mention so I assume that it is not required ... but it would be
> assertion is issued to - and may only be used by - the intended client.
> Obviously this is straight forward enough, really I'm just looking to be
> sure that I'm not missing anything.
>
> tx
>
> adam
>
>

---

From: Brian Campbell <[email-masked]>
Date: Fri, 15 Mar 2013 16:12:55 -0600

So currently the base assertion document defines scope as an HTTP parameter
on the access token request message when using an assertion as a grant[1].
And that applies to both the SAML and JWT grants (perhaps that needs to be
more clear?). Also RFC 6749 defines the scope parameter for the client
credentials access token request[2], which similarly applies to both SAML
and JWT in the case of assertion client authentication using the
"client_credentials" grant type.

[1] http://tools.ietf.org/html/draft-ietf-oauth-assertions-10#section-4.1
[2] http://tools.ietf.org/html/rfc6749#section-4.4.1

On Fri, Mar 15, 2013 at 3:43 PM, Lewis Adam-CAL022 <
[email-masked]> wrote:

> Right ... thinking about this further I think the answer is "all of the
> above."  If the JWT is a grant type then as you say it needs a scope param
> and optionally a client_id param.  I argued for the client_id param earlier
> since it could assist with HOK scenarios once those further develop.
>
> > Coming back to this...  am I correct in that client_id is not required?
>    We are implementing this spec and want to make sure that we are doing it
> right.    By my understanding the only two parameters that are required in
> the JWT grant type are  "urn:ietf:params:oauth:grant-type:jwt-bearer"
>  and the assertion.      Is this correct?
> >

---

From: Brian Campbell <[email-masked]>
Date: Fri, 15 Mar 2013 16:15:56 -0600

Codifying a claim/attribute for scope that goes in the assertion is
something that's been discussed but never seemed to get sufficient
consensus regarding how to exactly to do it and if it really provided much
value.

On Fri, Mar 15, 2013 at 4:12 PM, Brian Campbell
<[email-masked]>wrote:

> So currently the base assertion document defines scope as an HTTP
> parameter on the access token request message when using an assertion as a
> grant[1].  And that applies to both the SAML and JWT grants (perhaps that
> needs to be more clear?). Also RFC 6749 defines the scope parameter for the
> client credentials access token request[2], which similarly applies to both
> SAML and JWT in the case of assertion client authentication using the

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Fri, 15 Mar 2013 22:50:35 +0000

Yeah ... I forgot about that.  I remember figuring that out at one point and then I guess I lost it.  So right, my vote would be to make it more clear, either by repeating the full list of params (my vote) or by at least making a reference.  It would be nice to be able to read the JWT or SAML profiles as a self-contained doc.

adam

From: Brian Campbell [mailto:[email-masked]]
Sent: Friday, March 15, 2013 5:13 PM
To: Lewis Adam-CAL022
Cc: Sergey Beryozkin; [email-masked]
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

So currently the base assertion document defines scope as an HTTP parameter on the access token request message when using an assertion as a grant[1].  And that applies to both the SAML and JWT grants (perhaps that needs to be more clear?). Also RFC 6749 defines the scope parameter for the client credentials access token request[2], which similarly applies to both SAML and JWT in the case of assertion client authentication using the "client_credentials" grant type.

On Fri, Mar 15, 2013 at 3:43 PM, Lewis Adam-CAL022 <[email-masked]<mailto:[email-masked]>> wrote:
Right ... thinking about this further I think the answer is "all of the above."  If the JWT is a grant type then as you say it needs a scope param and optionally a client_id param.  I argued for the client_id param earlier since it could assist with HOK scenarios once those further develop.

adam

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Sergey Beryozkin
Sent: Friday, March 15, 2013 4:31 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Hi

Cheers, Sergey

> Thoughts?
>
> adam
>
> *From:*John Bradley [mailto:[email-masked]<mailto:[email-masked]>]
> *Cc:* Brian Campbell; "WG <[email-masked]<mailto:[email-masked]>>"@il06exr02.mot.com<http://il06exr02.mot.com>
> <[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>> wrote:
>
>
>
> *From:*Brian Campbell [mailto:[email-masked]<mailto:[email-masked]>
> *Cc:*Mike Jones; "WG <[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>>"@il06exr02.mot.com<http://il06exr02.mot.com> <http://il06exr02.mot.com>
> <[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>> wrote:
>
> *From:*Mike Jones [mailto:[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>]
> *To:*Lewis Adam-CAL022;[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>WG
> *From:[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>[mailto:[email-masked]<mailto:[email-masked]>
> <mailto:[email-masked]<mailto:[email-masked]>>]*On Behalf Of*Lewis Adam-CAL022
> *To:[email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>WG
> [email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>
> [email-masked]<mailto:[email-masked]> <mailto:[email-masked]<mailto:[email-masked]>>

---

From: Lewis Adam-CAL022 <[email-masked]>
Date: Fri, 15 Mar 2013 22:54:40 +0000

I guess that it depends on what JWT is meant to be.  My understanding is that it began as something to support Web SSO authentication for OIDC, so scope didn't make any sense then.  Nor does it make any sense as a strict grant type.  The use case where it becomes interesting (the one I am looking to) is for when an access token or refresh token is a JWT.  I think some vendors are beginning to make their structured tokens a JWT, and that is my current thinking as well ... if folks agree that JWT can be used as the structure for OAuth tokens, then it makes sense to include a scope field.  If not, then it will be JSON+encryption+signing, just not a JWT :)

adam

From: Brian Campbell [mailto:[email-masked]]
Sent: Friday, March 15, 2013 5:16 PM
To: Lewis Adam-CAL022
Cc: Sergey Beryozkin; [email-masked]
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Codifying a claim/attribute for scope that goes in the assertion is something that's been discussed but never seemed to get sufficient consensus regarding how to exactly to do it and if it really provided much value.

On Fri, Mar 15, 2013 at 4:12 PM, Brian Campbell <[email-masked]<mailto:[email-masked]>> wrote:
So currently the base assertion document defines scope as an HTTP parameter on the access token request message when using an assertion as a grant[1].  And that applies to both the SAML and JWT grants (perhaps that needs to be more clear?). Also RFC 6749 defines the scope parameter for the client credentials access token request[2], which similarly applies to both SAML and JWT in the case of assertion client authentication using the "client_credentials" grant type.

adam

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Sergey Beryozkin
Sent: Friday, March 15, 2013 4:31 PM
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] JWT grant_type and client_id

Hi

Cheers, Sergey

---

From: Sergey Beryozkin <[email-masked]>
Date: Tue, 19 Mar 2013 10:22:01 +0000

Hi,

Just one remark, the example in [1] shows "client_id"; IMHO it makes 
sense to clarify than in this context (where the assertion is used as a 
grant), it is optional as per:

http://tools.ietf.org/html/rfc6749#section-3.2.1

"A client MAY use the "client_id" request parameter to identify itself
  when sending requests to the token endpoint"

and otherwise

http://tools.ietf.org/html/rfc6749#section-2.3

dictates how the client authentication is done.

By the way, my reading of the main spec's section 2.3 tells me that the 
only time one would use only "client_id" in the form payload is when the 
client secret is empty or perhaps the client is not in the possession of 
the secret.

Does it make sense to completely drop a "client_id" parameter in the 
example at [1] in the assertion draft and use an example with a Basic 
authentication instead ?

Thanks, Sergey

On 15/03/13 22:12, Brian Campbell wrote:
> parameter on the access token request message when using an assertion as
> a grant[1].  And that applies to both the SAML and JWT grants (perhaps
> that needs to be more clear?). Also RFC 6749 defines the scope parameter
> for the client credentials access token request[2], which similarly
> applies to both SAML and JWT in the case of assertion client
> authentication using the "client_credentials" grant type.
>
> On Fri, Mar 15, 2013 at 3:43 PM, Lewis Adam-CAL022
>     Right ... thinking about this further I think the answer is "all of
>     the above."  If the JWT is a grant type then as you say it needs a
>     scope param and optionally a client_id param.  I argued for the
>     client_id param earlier since it could assist with HOK scenarios
>     once those further develop.
>
>     From: [email-masked] <mailto:[email-masked]>
>     [mailto:[email-masked] <mailto:[email-masked]>] On
>     Behalf Of Sergey Beryozkin
>     To: [email-masked] <mailto:[email-masked]>
>      > *Cc:* Brian Campbell; "WG <[email-masked]
>      > Having a standard claim in JWT and SAML for passing scopes is
>     probably
>      > useful as part of a profile.
>      >
>      > John B.
>      >
>     <mailto:[email-masked]>
>      > <mailto:[email-masked]
>     <mailto:[email-masked]>>> wrote:
>      >
>      >
>      >
>     <mailto:[email-masked]>
>      > *Cc:*Mike Jones; "WG <[email-masked] <mailto:[email-masked]>
>      > <mailto:[email-masked]
>     <mailto:[email-masked]>>>"@il06exr02.mot.com
>     <http://il06exr02.mot.com> <http://il06exr02.mot.com>
>     <mailto:[email-masked]>
>      > <mailto:[email-masked]
>     <mailto:[email-masked]>>> wrote:
>      >
>      > Coming back to this...  am I correct in that client_id is not
>     required?    We are implementing this spec and want to make sure
>     that we are doing it right.    By my understanding the only two
>     parameters that are required in the JWT grant type are
>     "urn:ietf:params:oauth:grant-type:jwt-bearer"    and the assertion.
>           Is this correct?
>      >
>     <mailto:[email-masked]>
>      > *To:*Lewis Adam-CAL022;[email-masked]
>     <mailto:[email-masked]> <mailto:[email-masked]
>     <mailto:[email-masked]>>WG
>      > *From:[email-masked] <mailto:[email-masked]>
>      > <mailto:[email-masked]
>     <mailto:[email-masked]>>[mailto:[email-masked]
>     <mailto:[email-masked]>
>      > <mailto:[email-masked]
>     <mailto:[email-masked]>>]*On Behalf Of*Lewis Adam-CAL022
>      > *To:[email-masked] <mailto:[email-masked]>
>     <mailto:[email-masked] <mailto:[email-masked]>>WG
>      > [email-masked] <mailto:[email-masked]> <mailto:[email-masked]
>     <mailto:[email-masked]>>
>      > [email-masked] <mailto:[email-masked]> <mailto:[email-masked]
>     <mailto:[email-masked]>>