Subject: [OAUTH-WG] Call for adoption of "JWT Response for OAuth Token Introspection"

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 19 Jul 2018 13:43:37 -0400

Hi all,

This is the call for adoption of the 'JWT Response for OAuth Token
Introspection' document following the presentation by Torsten at the
Montreal IETF meeting where we didn't have a chance to do a call for
adoption in the meeting itself.

Here is presentation by Torsten:
https://datatracker.ietf.org/meeting/102/materials/slides-102-oauth-sessa-jwt-response-for-oauth-token-introspection-00

Here is the document:
https://tools.ietf.org/html/draft-lodderstedt-oauth-jwt-introspection-response-01

Please let us know by August 2nd whether you accept / object to the
adoption of this document as a starting point for work in the OAuth working
group.

Regards,
Hannes & Rifaat

---

From: William Denniss <[email-masked]>
Date: Thu, 19 Jul 2018 10:51:03 -0700

I support adoption of this document by the working group.

On Thu, Jul 19, 2018 at 10:43 AM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

> https://datatracker.ietf.org/meeting/102/materials/slides-
> 102-oauth-sessa-jwt-response-for-oauth-token-introspection-00
>
> Here is the document:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Anthony Nadalin <[email-masked]>
Date: Fri, 20 Jul 2018 14:06:52 +0000

I’m concerned over the security implications of a client being able to introspect a token, for bearer tokens this can be very problematic, so unless the issues with possible token theft can be addressed I don’t support this as a WG draft

From: OAuth <[email-masked]> On Behalf Of Rifaat Shekh-Yusef
Sent: Thursday, July 19, 2018 10:44 AM
To: oauth <[email-masked]>
Subject: [OAUTH-WG] Call for adoption of "JWT Response for OAuth Token Introspection"

Hi all,

This is the call for adoption of the 'JWT Response for OAuth Token Introspection' document following the presentation by Torsten at the Montreal IETF meeting where we didn't have a chance to do a call for adoption in the meeting itself.

Here is presentation by Torsten:
https://datatracker.ietf.org/meeting/102/materials/slides-102-oauth-sessa-jwt-response-for-oauth-token-introspection-00<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fmeeting%2F102%2Fmaterials%2Fslides-102-oauth-sessa-jwt-response-for-oauth-token-introspection-00&data=02%7C01%7Ctonynad%40microsoft.com%7C5bb4d12618944cc8da4b08d5ed9f386b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636676190478079368&sdata=wv8e%2FvGDm9LzeJaGrOBD8oGXgPSquNE%2BRKiEknF8sq4%3D&reserved=0>

Here is the document:
https://tools.ietf.org/html/draft-lodderstedt-oauth-jwt-introspection-response-01<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-lodderstedt-oauth-jwt-introspection-response-01&data=02%7C01%7Ctonynad%40microsoft.com%7C5bb4d12618944cc8da4b08d5ed9f386b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636676190478079368&sdata=cFISOVma8g%2BXdvf2KZdwCZBYlpfN%2FGb2knv8ZD9sKz4%3D&reserved=0>

Please let us know by August 2nd whether you accept / object to the adoption of this document as a starting point for work in the OAuth working group.

Regards,
Hannes & Rifaat

---

From: John Bradley <[email-masked]>
Date: Fri, 20 Jul 2018 10:14:17 -0400

I am in favor of adoption.

Sent from Mail for Windows 10

From: Rifaat Shekh-Yusef
Sent: Thursday, July 19, 2018 1:44 PM
To: oauth
Subject: [OAUTH-WG] Call for adoption of "JWT Response for OAuth TokenIntrospection"

Hi all,

Here is the document:

Regards,
Hannes & Rifaat

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 20 Jul 2018 14:15:59 +0000

There are companies doing token introspection by the client already, see https://backstage.forgerock.com/docs/am/6/oauth2-guide/#sec-standards

What security implications do you see?

From: OAuth [mailto:[email-masked]] On Behalf Of Anthony Nadalin
Sent: 20 July 2018 10:07
To: Rifaat Shekh-Yusef; oauth
Subject: Re: [OAUTH-WG] Call for adoption of "JWT Response for OAuth Token Introspection"

Hi all,

Here is the document:

Regards,
Hannes & Rifaat
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 20 Jul 2018 16:20:09 +0200

> Am 20.07.2018 um 16:06 schrieb Anthony Nadalin <tonynad=[email-masked]>:
> 

Hi Tony,

I think this an issue for introspection in general and not specific to our extension.

If the token content needs to be kept confidential then the AS MUST authenticate the caller of the Introspection endpoint and apply an suitable authz policy. This is possible with Token Introspection and with our draft as well. 

Additionally, our draft allows to encrypt the token response, adding an extra layer of defense. 

kind regards,
Torsten.

---

From: Brian Campbell <[email-masked]>
Date: Fri, 20 Jul 2018 10:21:37 -0400

+1

On Thu, Jul 19, 2018 at 1:51 PM, William Denniss <
wdenniss=[email-masked]> wrote:

> On Thu, Jul 19, 2018 at 10:43 AM, Rifaat Shekh-Yusef <
> [email-masked]> wrote:
>
>> Hi all,
>>
>> https://datatracker.ietf.org/meeting/102/materials/slides-10
>> 2-oauth-sessa-jwt-response-for-oauth-token-introspection-00
>>
>> Here is the document:

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Rob Otto <[email-masked]>
Date: Fri, 20 Jul 2018 15:25:35 +0100

I support this as well

On Fri, 20 Jul 2018 at 15:22, Brian Campbell <bcampbell=
[email-masked]> wrote:

> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited..
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*_______________________________________________
> OAuth mailing list
> [email-masked]

-- 
<https://www.pingidentity.com>
<https://www.pingidentity.com>
Rob Otto
EMEA Field CTO/Solutions Architect
[email-masked]

c: +44 (0) 777 135 6092
Connect with us: 
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
logo] <https://twitter.com/pingidentity> 
<https://www.facebook.com/pingidentitypage> 
<https://www.youtube.com/user/PingIdentityTV> 
<https://plus.google.com/u/0/114266977739397708540> 
<https://www.pingidentity.com/en/blog.html>
<https://www.gartner.com/doc/reprints?id=1-5423XKW&ct=180620&st=sb>

---

From: Phil Hunt <[email-masked]>
Date: Fri, 20 Jul 2018 08:39:56 -0700

+1 adoption

I have always been concerned about clients doing introspection. Use of jwt helps because responses further restricted rather than less (jwe). 

Phil

> On Jul 20, 2018, at 7:25 AM, Rob Otto <robotto=[email-masked]> wrote:
> 
> I support this as well 
> 
>> On Fri, 20 Jul 2018 at 15:22, Brian Campbell <bcampbell=[email-masked]> wrote:
>> +1 
>> 
>>> On Thu, Jul 19, 2018 at 1:51 PM, William Denniss <wdenniss=[email-masked]> wrote:
>>>> On Thu, Jul 19, 2018 at 10:43 AM, Rifaat Shekh-Yusef <[email-masked]> wrote:
>>>> Hi all,
>>>> 
>> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited...  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________
>> OAuth mailing list
>> [email-masked]
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

---

From: Mark Dobrinic <[email-masked]>
Date: Fri, 20 Jul 2018 17:47:30 +0200

I +1 this,

but at the same time, I'm wondering what happened with the argument that
this should be solved by Token Exchange instead of Introspect?

Cheers!

Mark

On 20/07/18 17:39, Phil Hunt wrote:
> +1 adoption
> 
> I have always been concerned about clients doing introspection. Use of
> jwt helps because responses further restricted rather than less (jwe). 
> 
> Phil
> 
> On Jul 20, 2018, at 7:25 AM, Rob Otto
> <robotto=[email-masked]
> <mailto:robotto=[email-masked]>> wrote:
> 
>> I support this as well 
>>
>> On Fri, 20 Jul 2018 at 15:22, Brian Campbell
>> <bcampbell=[email-masked]
>> <mailto:[email-masked]>> wrote:
>>
>>     +1
>>
>>     On Thu, Jul 19, 2018 at 1:51 PM, William Denniss
>>     <wdenniss=[email-masked]
>>     <mailto:wdenniss=40google.com@dmarc..ietf.org>> wrote:
>>
>>         On Thu, Jul 19, 2018 at 10:43 AM, Rifaat Shekh-Yusef
>>         <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>             Hi all,
>>
>>             This is the call for adoption of the 'JWT Response for
>>             OAuth Token Introspection' document following the
>>             presentation by Torsten at the Montreal IETF meeting where
>>             we didn't have a chance to do a call for adoption in the
>>             meeting itself.
>>
>>             Please let us know by August 2nd whether you accept /
>>             object to the adoption of this document as a starting
>>             point for work in the OAuth working group.
>>
>>             Regards,
>>             Hannes & Rifaat
>>
>>             [email-masked] <mailto:[email-masked]>
>>         [email-masked] <mailto:[email-masked]>
>>     /CONFIDENTIALITY NOTICE: This email may contain confidential and
>>     privileged material for the sole use of the intended recipient(s).
>>     Any review, use, distribution or disclosure by others is strictly
>>     prohibited...  If you have received this communication in error,
>>     please notify the sender immediately by e-mail and delete the
>>     message and any file attachments from your computer. Thank
>>     you./_______________________________________________
>>     OAuth mailing list
>>     [email-masked] <mailto:[email-masked]>
>> <https://www.pingidentity.com>Ping Identity
>> [email-masked] <mailto:[email-masked]>	
>>
>> c: +44 (0) 777 135 6092	
>>
>> Connect with us: 	Glassdoor logo
>> LinkedIn logo <https://www.linkedin.com/company/21870> twitter logo
>> <https://twitter.com/pingidentity>	facebook logo
>> <https://www.facebook.com/pingidentitypage>	youtube logo
>> <https://www.youtube.com/user/PingIdentityTV>	Google+ logo
>> <https://plus.google.com/u/0/114266977739397708540> Blog logo
>> /CONFIDENTIALITY NOTICE: This email may contain confidential and
>> review, use, distribution or disclosure by others is strictly
>> prohibited..  If you have received this communication in error, please
>> notify the sender immediately by e-mail and delete the message and any
>> file attachments from your computer. Thank you./
>> [email-masked] <mailto:[email-masked]>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 21 Jul 2018 18:53:45 +0200

Hi Mark,
> Am 20.07.2018 um 17:47 schrieb Mark Dobrinic <[email-masked]>:
> 
> I +1 this,

thanks

> this should be solved by Token Exchange instead of Introspect?

We presented two use case in London, (1) providing evidence for the RS’s audit log and (2) providing/transforming tokens by a reverse proxy in front of a resource server.

The WG advised us to consider token exchange for (2) so the current draft only addresses (1).

kind regards,
Torsten.

---

From: Filip Skokan <[email-masked]>
Date: Sat, 21 Jul 2018 19:12:40 +0200

I support the adoption or this document by the WG. 

Filip Skokan

Odesláno z iPhonu

---

From: Hans Zandbelt <[email-masked]>
Date: Sat, 21 Jul 2018 19:54:09 +0200

+1

Hans.

-- 
[email-masked]
ZmartZone IAM - www.zmartzone.eu