Subject: [OAUTH-WG] Dealing with oAuth redirect_uri in draft-parecki-oauth-v2-1 and need for AS back channel initiation endpoint

From: Francis Pouatcha <[email-masked]>
Date: Wed, 8 Apr 2020 18:01:04 -0400

There is a lot of effort associated with the handling and correct
validation of a redirect_uri sent to the AS as part of the front channel
authorization request, as this gets transported by user agents.

The draft-parecki-oauth-v2-1 as a replacement of RFC 6749 must make sure
redirect_uri is only sent to the AS through the back channel. This of
course requires the implementation of a new "authorization request
initiation endpoint". The draft-ietf-oauth-par-01 provides a guidance on
how to design this initiation endpoint.

-- 
Francis Pouatcha
Co-Founder and Technical Lead at adorys
https://adorsys-platform.de/solutions/

---

From: Aaron Parecki <[email-masked]>
Date: Wed, 8 Apr 2020 15:05:27 -0700

Hi Francis,

As much as I would love to require that all authorization requests are
initiated via a back channel, that is unfortunately not something that is
in scope of the current OAuth 2.1 document.

The OAuth 2.0 Security BCP and this document require strict redirect URI
matching, which should help simplify the AS, since simple string matching
is sufficient now.

----
Aaron Parecki
aaronparecki.com
@aaronpk <http://twitter.com/aaronpk>

---

From: Francis Pouatcha <[email-masked]>
Date: Wed, 8 Apr 2020 18:30:50 -0400

Hello Aaron,

> matching, which should help simplify the AS, since simple string matching
Not sure it is a good idea to limit scope oAuth 2.1 on existing
functionality of oAuth 2.0 unless we are planning an oAuth 3.0 soon.
-- 
Francis Pouatcha
Co-Founder and Technical Lead at adorys
https://adorsys-platform.de/solutions/

---

From: Justin Richer <[email-masked]>
Date: Wed, 8 Apr 2020 19:20:19 -0400

Francis,

The backchannel-first pattern that you are discussing is one of the key components of TxAuth, which we are discussing on the [email-masked] <mailto:[email-masked]> mailing list, and I invite you to join the conversation there. I have a project to implement these ideas that’s documented at https://oauth.xyz/ <https://oauth.xyz/>, and it’s been submitted as a draft to what will hopefully become the TxAuth Working Group in the near future. 

https://tools.ietf.org/html/draft-richer-transactional-authz <https://tools.ietf.org/html/draft-richer-transactional-authz>

 — Justin

> On Apr 8, 2020, at 6:30 PM, Francis Pouatcha <fpo=[email-masked]> wrote:
> 
> Hello Aaron,
> As much as I would love to require that all authorization requests are initiated via a back channel, that is unfortunately not something that is in scope of the current OAuth 2.1 document.
> 
> The OAuth 2.0 Security BCP and this document require strict redirect URI matching, which should help simplify the AS, since simple string matching is sufficient now.
> Not sure it is a good idea to limit scope oAuth 2.1 on existing functionality of oAuth 2.0 unless we are planning an oAuth 3.0 soon. 
> -- 
> Francis Pouatcha
> https://adorsys-platform.de/solutions/ <https://adorsys-platform.de/solutions/>_______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth