Subject: [scim] signed JSON objects instead of OAuth 2?

From: Bill Mills <[email-masked]>
Date: Fri, 2 May 2014 17:00:36 -0700 (PDT)

What does the group think of using signed JSON objects for authentication rather than OAuth?

-bill

---

From: Phil Hunt <[email-masked]>
Date: Fri, 2 May 2014 18:18:39 -0700

I think the primary use case for SCIM was point-to-point provisioning which is sufficiently secured through the use of TLS. This might be further solidified by the work being done in OAuth WG on POP/MAC tokens to provide mutual-authentication as well as payload integrity and confidentiality.
—> this is a good item for the security considerations.

I think “signing” becomes relevant when SCIM payload data is being handled by intermediaries (handled by multiple entities) where it becomes important to prove that the data has not been altered in a multi-hop-path in an end-to-end security fashion.

Maybe this would be a good extension?

What use case did you have in mind?

Phil

@independentid
www.independentid.com
[email-masked]

On May 2, 2014, at 5:00 PM, Bill Mills <[email-masked]> wrote:

> _______________________________________________
> scim mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/scim

---

From: Bill Mills <[email-masked]>
Date: Fri, 2 May 2014 21:39:41 -0700 (PDT)

OAuth just isn't my favorite choice here, in the end it's just a proxy for some other shared secret.  A JWT potentially cuts out the OAuth middleman.
On Friday, May 2, 2014 6:18 PM, Phil Hunt <[email-masked]> wrote:

Phil

@independentid
[email-masked]

---

From: Phil Hunt <[email-masked]>
Date: Fri, 2 May 2014 21:56:45 -0700

Lets go back to basics. :-)

What's the scenario where by you feel you need jws?

Phil

> On May 2, 2014, at 21:39, Bill Mills <[email-masked]> wrote:
>

---

From: Bill Mills <[email-masked]>
Date: Fri, 2 May 2014 22:13:49 -0700 (PDT)

Regular SCIM auth.  I just have never liked the OAuth 2 solution much.  What else can we do?
On Friday, May 2, 2014 9:56 PM, Phil Hunt <[email-masked]> wrote:

Phil

---

From: Phil Hunt <[email-masked]>
Date: Fri, 2 May 2014 22:22:00 -0700

Are you trying to authen the parties or prove the payload is not corrupted by having it signed?

TLS can do most of the work can it not?

Phil

> On May 2, 2014, at 22:13, Bill Mills <[email-masked]> wrote:
>

---

From: Phil Hunt <[email-masked]>
Date: Sat, 3 May 2014 00:46:43 -0700

Bill,

Are you going to IIW next week? Let's chat then. 

Phil

---

From: Bill Mills <[email-masked]>
Date: Sat, 3 May 2014 11:03:44 -0700 (PDT)

Yep I will be at IIW
On Saturday, May 3, 2014 12:46 AM, Phil Hunt <[email-masked]> wrote:
 
Bill,

Phil