Subject: [Ace] CWT - Scope Claim

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 31 Oct 2017 09:28:28 +0000

Hi all,

I was wondering whether we should define a claim, scope, that captures the scope that was granted by the authorization server.

Ciao
Hannes
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Samuel Erdtman <[email-masked]>
Date: Tue, 31 Oct 2017 10:46:11 +0100

The framework does register a CWT 'scoop' claim, but I think it has to
register it with JWT too to be correct.

https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-08#section-8.5

//Samuel

On Tue, Oct 31, 2017 at 10:28 AM, Hannes Tschofenig <
[email-masked]> wrote:

> Hi all,
>
>
>
> I was wondering whether we should define a claim, scope, that captures the
> scope that was granted by the authorization server.
>
>
>
> Ciao
>
> Hannes
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 31 Oct 2017 09:57:54 +0000

Hi Samuel,

You are correct that we should register it also with the JWT.

Additionally, I wonder whether the string representation of the claim for the CWT is the most efficient way to represent the scope. Shouldn’t we rather use CBOR capabilities here since we are trying to optimize 2 bytes in other areas?

Ciao
Hannes

From: Samuel Erdtman [mailto:[email-masked]]
Sent: 31 October 2017 10:46
To: Hannes Tschofenig
Cc: [email-masked]
Subject: Re: [Ace] CWT - Scope Claim

The framework does register a CWT 'scoop' claim, but I think it has to register it with JWT too to be correct.

//Samuel

On Tue, Oct 31, 2017 at 10:28 AM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

Ciao
Hannes

_______________________________________________
Ace mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ace

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 31 Oct 2017 09:58:38 +0000

An additional though: would it make sense to put the scope claim into the CWT instead of putting it into the oauth-authz framework?

//Samuel

Ciao
Hannes

---

From: Jim Schaad <[email-masked]>
Date: Tue, 31 Oct 2017 08:06:04 -0700

I have an outstanding comment to the effect that I want a binary scope value – specifically to allow for a CBOR encoded object – on the framework document.

In terms of defining it in this document rather than in the framework, my first response would be ‘no’ only because this was designed to be a direct copy of the JWT document and it was not defined there.  Other than that I would not care one way or the other.

Jim

From: Ace [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Tuesday, October 31, 2017 2:58 AM
To: Samuel Erdtman <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ace] CWT - Scope Claim

Hi Samuel, 

Ciao

Hannes

From: Samuel Erdtman [mailto:[email-masked]] 
Sent: 31 October 2017 10:46
To: Hannes Tschofenig
Cc: [email-masked] <mailto:[email-masked]> 
Subject: Re: [Ace] CWT - Scope Claim

//Samuel

On Tue, Oct 31, 2017 at 10:28 AM, Hannes Tschofenig <[email-masked] <mailto:[email-masked]> > wrote:

Hi all, 

Ciao

Hannes

_______________________________________________
Ace mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/ace

---

From: Mike Jones <[email-masked]>
Date: Tue, 31 Oct 2017 20:08:58 +0000

I agree that CWT shouldn't define claims beyond those that correspond to the JWT claims.  Other specs can do that via the registry established for that purpose.

-- Mike
________________________________
From: Ace <[email-masked]> on behalf of Jim Schaad <[email-masked]>
Sent: Tuesday, October 31, 2017 8:06:04 AM
To: Hannes Tschofenig; 'Samuel Erdtman'
Cc: [email-masked]
Subject: Re: [Ace] CWT - Scope Claim

Jim

Hi Samuel,

Ciao
Hannes

From: Samuel Erdtman [mailto:[email-masked]]
Sent: 31 October 2017 10:46
To: Hannes Tschofenig
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ace] CWT - Scope Claim

//Samuel

Ciao
Hannes