Subject: Re: [core] [Ace] Unique resource identifiers

From: Eve Maler <[email-masked]>
Date: Mon, 9 Mar 2015 09:28:20 -0700

FYI, a side-effect of the UMA model of enabling loose coupling of a resource server and authorization server was that the RS has to register "resource sets" (nominally sets of multiple resources, but in practice individual resources) and available scopes over them with the AS, so that the AS can attach authorization policies to them. The act of registration involves creating a (web) resource on the AS side, for which the AS ends up assigning a resource ID and sending back an ID in a Location header.

Info on this mechanism is in this spec (which is generic and could be applied to OAuth and OIDC, as well as UMA):

http://tools.ietf.org/html/draft-hardjono-oauth-resource-reg-05

	Eve

> On 21 Jan 2015, at 6:06 AM, Ludwig Seitz <[email-masked]> wrote:
> 
> Hello,
> 
> I'm just (re-)thinking the issue of authorization tokens and how to
> encode authorization decisions, and the following problem has come up:
> 
> We need to uniquely identify a resource in order to do any kind of
> non-local authorization on it.
> 
> At first the obvious approach seemed to be to use Uri-host and Uri-path
> of the origin server, but there are several problems with this:
> 
> 
> 1.) The origin server might change address, see e.g.
> http://www.ietf.org/mail-archive/web/core/current/msg05625.html
> 
> 2.) The resource might not be on the origin server when access control
> has to be performed, say e.g. a store-and-forward scenario, or a
> publish-subscribe scenario as in
> http://tools.ietf.org/html/draft-koster-core-coapmq-00.
> 
> I think we might need some unique resource identifier that is neither
> dependent on the host address nor on the internal resource hierarchies
> on the origin server.
> 
> The added benefit would be that a proxy could handle encrypted
> resource representations, without gaining any knowledge about the
> internal resource structure on the origin server.
> 
> What do you think about this issue?
> 
> Regards,
> 
> Ludwig Seitz
> 
> PS: Sorry for cross-posting this to CoRE, but I suspect we might get
> some useful input from there.
> 
> -- 
> Ludwig Seitz, PhD
> SICS Swedish ICT AB
> Ideon Science Park
> Building Beta 2
> Scheelevägen 17
> SE-223 70 Lund
> 
> Phone +46(0)70-349 92 51
> http://www.sics.se
> 
> 
> 
> 
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl