Subject: [Txauth] New version of XYZ

From: Justin Richer <[email-masked]>
Date: Wed, 22 Apr 2020 17:36:18 -0400

I’ve updated the XYZ code, site, and specification text to add a couple of interesting ideas from XAuth. In particular: 

1: You can now send an OPTIONS request to the transaction endpoint to get back a JSON document. I’m still not positive what needs to go in there, since the protocol is designed to allow a fully dynamic interaction without a separate discovery step. Having a a separate step for required discovery has been shown to have negative security ramifications in OAuth 2, but it could allow for a smarter client to perform an optimized request for a given AS. What I’ve spec’d out so far is listing out the possible values for interaction, claims, proofing methods, and capabilities. I could see resource types (from RAR) and other things going in there as well. In all cases, the client doesn’t :need: this information to call the tx endpoint, but it might help in some cases.

2: You can now sign the request to the transaction endpoint using an internal JWS. This requires the body to be of type application/Jose instead of application/json, and so the normative language around that is a little weird. We implemented AS support for this in our Java server by using a filter to check for JOSE on the way in and extracting the JSON payload, which is then processed like a regular JSON request would be. This kind of filtering could be done with a termination proxy as well, which might be how a lot of the key proofing is handled in practice (especially MTLS). 

As always, the site has more detail and explanation: https://oauth.xyz/ <https://oauth.xyz/>

The code is up on GitHub.

 — Justin

> A new version of I-D, draft-richer-transactional-authz-08.txt
> has been successfully submitted by Justin Richer and posted to the
> IETF repository.
> 
> Name:		draft-richer-transactional-authz
> Revision:	08
> Title:		Transactional Authorization
> Document date:	2020-04-22
> Group:		Individual Submission
> Pages:		35
> URL:            https://www.ietf.org/internet-drafts/draft-richer-transactional-authz-08.txt
> Status:         https://datatracker.ietf.org/doc/draft-richer-transactional-authz/
> Htmlized:       https://tools.ietf.org/html/draft-richer-transactional-authz-08
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-richer-transactional-authz
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-richer-transactional-authz-08
> 
> Abstract:
>   This document defines a mechanism for delegating authorization to a
>   piece of software, and conveying that delegation to the software.
> 
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
> 
>