Subject: [IPP] Oauth for IPP System Service

From: Piotr Pawliczek via ipp <[email-masked]>
Date: Wed, 7 Oct 2020 13:08:42 -0700

Hi,

I am trying to figure out how to implement oauth authentication for the IPP
System (e.g.: needed to send the Get-Printers request). I cannot find any
references to oauth authorization in the document "IPP System Service v1.0
(SYSTEM)". Is there any plan to describe oauth authentication on the level
of IPP System?
The only reference to oauth I could find is in "IPP Authentication Methods
v1.0". In that document, the oauth authorization is defined on the Printer
level. In that case, Get-Printer-Attributes returns necessary data to
perform oauth authorization. How to do oauth authorization for Get-Printers
request?

Thanks,
Piotr Pawliczek
_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: Michael Sweet via ipp <[email-masked]>
Date: Wed, 7 Oct 2020 16:16:45 -0400

Piotr,

> On Oct 7, 2020, at 4:08 PM, Piotr Pawliczek via ipp <[email-masked]> wrote:
> 
> Hi,
> 
> I am trying to figure out how to implement oauth authentication for the IPP System (e.g.: needed to send the Get-Printers request). I cannot find any references to oauth authorization in the document "IPP System Service v1.0 (SYSTEM)". Is there any plan to describe oauth authentication on the level of IPP System?

OAuth happens at the HTTP level, so the IPP Authentication Methods v1.0 document applies to all IPP services, not just printing.

________________________
Michael Sweet

---

From: "Kennedy, Smith \(Wireless & IPP Standards\) via ipp" <[email-masked]>
Date: Wed, 7 Oct 2020 20:51:15 +0000

Hi there,

In "IPP Authentication Methods v1.0" on page 19 (https://ftp.pwg.org/pub/pwg/informational/bp-ippauth10-20190816-5199.10.pdf#page=19 <https://ftp.pwg.org/pub/pwg/informational/bp-ippauth10-20190816-5199.10.pdf#page=19>), edge 13 says 'Check for "oauth-authorization-server-uri" and "oauth-authorization-scope" Printer Description attributes'. If the IPP System supported OAuth, then presumably a Client could do a Get-System-Attributes operation to get these same two attributes.

But if the System is allowed to respond with an authentication challenge (similar to Get-User-Printer-Attributes but not similar to Get-Printer-Attributes) then we have a problem because those two OAuth attributes can't be acquired by the Client. I cannot tell from the definition of "Get-System-Attributes" in IPP System v1.0 (http://ftp.pwg.org/pub/pwg/candidates/cs-ippsystem10-20191122-5100.22.pdf#page=70 <http://ftp.pwg.org/pub/pwg/candidates/cs-ippsystem10-20191122-5100.22.pdf#page=70>) whether a System object is allowed to challenge a Client for authentication in response to a Get-System-Attributes operation request.

Piotr, did I capture your "chicken-and-egg" concerns here?

Smith

/**
    Smith Kennedy
    HP Inc.
*/

> On Oct 7, 2020, at 2:16 PM, Michael Sweet via ipp <[email-masked]> wrote:
> 
> Piotr,
> 
> https://www.pwg.org/mailman/listinfo/ipp <https://www.pwg.org/mailman/listinfo/ipp>

---

From: Michael Sweet via ipp <[email-masked]>
Date: Wed, 7 Oct 2020 17:03:13 -0400

Smith/All,

I think given the precedent of Get-Printer-Attributes, we should consider that Get-System-Attributes has a similar limitation (no authentication) in order to allow Clients to discover a system service.  And we can log an issue against the system service spec to track a future errata update that clarifies all of this... :/

> On Oct 7, 2020, at 4:51 PM, Kennedy, Smith (Wireless & IPP Standards) <[email-masked]> wrote:
> 
> Hi there,
> 
> In "IPP Authentication Methods v1.0" on page 19 (https://ftp.pwg.org/pub/pwg/informational/bp-ippauth10-20190816-5199.10.pdf#page=19), edge 13 says 'Check for "oauth-authorization-server-uri" and "oauth-authorization-scope" Printer Description attributes'. If the IPP System supported OAuth, then presumably a Client could do a Get-System-Attributes operation to get these same two attributes. 
> 
> But if the System is allowed to respond with an authentication challenge (similar to Get-User-Printer-Attributes but not similar to Get-Printer-Attributes) then we have a problem because those two OAuth attributes can't be acquired by the Client. I cannot tell from the definition of "Get-System-Attributes" in IPP System v1.0 (http://ftp.pwg.org/pub/pwg/candidates/cs-ippsystem10-20191122-5100.22.pdf#page=70) whether a System object is allowed to challenge a Client for authentication in response to a Get-System-Attributes operation request.
> 

________________________
Michael Sweet

---

From: "Kennedy, Smith \(Wireless & IPP Standards\) via ipp" <[email-masked]>
Date: Wed, 7 Oct 2020 21:08:52 +0000

Errata filed: https://www.pwg.org/dynamo/issues.php?U0+P-1+S-2+I0+E0+Z68+Q <https://www.pwg.org/dynamo/issues.php?U0+P-1+S-2+I0+E0+Z68+Q>

Smith

> On Oct 7, 2020, at 3:03 PM, Michael Sweet <[email-masked]> wrote:
> 
> Smith/All,
>

---

From: "Kennedy, Smith \(Wireless & IPP Standards\) via ipp" <[email-masked]>
Date: Wed, 7 Oct 2020 21:14:17 +0000

Hi Piotr,

I filed two errata against 5100.22: one to have Get-System-Attributes authentication semantics clarified, and another to have "oauth-authorization-server-uri" and "oauth-authorization-scope" attributes added as System Description attributes. The expectation is that a System object MUST NOT challenge a Client for authentication. Given that, if a System object supported OAuth, it ought to provide the "oauth-authorization-server-uri" and "oauth-authorization-scope" attributes as System Description attributes.

Smith

/**
    Smith Kennedy
    HP Inc.
*/

> On Oct 7, 2020, at 2:56 PM, Piotr Pawliczek <[email-masked]> wrote:
> 
> Hi Smith,
> 
> Yes! Thank you very much. This is the problem I run into.
> I just forgot to check Get-System-Attributes, so I didn't mention it.
> 
> Piotr
> 
> 
> On Wed, Oct 7, 2020 at 1:51 PM Kennedy, Smith (Wireless & IPP Standards) <[email-masked] <mailto:[email-masked]>> wrote:
> Hi there,
> 
>> On Oct 7, 2020, at 2:16 PM, Michael Sweet via ipp <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Piotr,
>> 
>> > On Oct 7, 2020, at 4:08 PM, Piotr Pawliczek via ipp <[email-masked] <mailto:[email-masked]>> wrote:
>> >
>> > Hi,
>> >
>> [email-masked] <mailto:[email-masked]>

---

From: Piotr Pawliczek via ipp <[email-masked]>
Date: Fri, 9 Oct 2020 09:48:37 -0700

Hi Smith,

Thank you very much for your help!
BTW, have you considered using an HTTP response header (see
https://tools.ietf.org/html/rfc6750#section-3) to communicate "server-uri"
and "scope" to the client?
In this case, we would not have to expose Get-System-Attributes
and Get-Printer-Attributes to everyone.

Best regards,
Piotr

On Wed, Oct 7, 2020 at 2:14 PM Kennedy, Smith (Wireless & IPP Standards) <
[email-masked]> wrote:

> Hi Piotr,
>
> I filed two errata against 5100.22: one to have Get-System-Attributes
> authentication semantics clarified, and another to have
> "oauth-authorization-server-uri" and "oauth-authorization-scope" attributes
> added as System Description attributes. The expectation is that a System
> object MUST NOT challenge a Client for authentication. Given that, if a
> System object supported OAuth, it ought to provide the
> "oauth-authorization-server-uri" and "oauth-authorization-scope" attributes
> as System Description attributes.
>
> Smith
>
> /**
>     Smith Kennedy
>     HP Inc.
> */
>
> On Wed, Oct 7, 2020 at 1:51 PM Kennedy, Smith (Wireless & IPP Standards) <
> [email-masked]> wrote:
>
>> Hi there,
>>
>> In "IPP Authentication Methods v1.0" on page 19 (
>> https://ftp.pwg.org/pub/pwg/informational/bp-ippauth10-20190816-5199.10.pdf#page=19),
>> edge 13 says 'Check for "oauth-authorization-server-uri" and
>> "oauth-authorization-scope" Printer Description attributes'. If the IPP
>> System supported OAuth, then presumably a Client could do a
>> Get-System-Attributes operation to get these same two attributes.
>>
>> But if the System is allowed to respond with an authentication challenge
>> (similar to Get-User-Printer-Attributes but not similar to
>> Get-Printer-Attributes) then we have a problem because those two OAuth
>> attributes can't be acquired by the Client. I cannot tell from the
>> definition of "Get-System-Attributes" in IPP System v1.0 (
>> http://ftp.pwg.org/pub/pwg/candidates/cs-ippsystem10-20191122-5100.22.pdf#page=70)
>> whether a System object is allowed to challenge a Client for authentication
>> in response to a Get-System-Attributes operation request.
>>
>> > I am trying to figure out how to implement oauth authentication for the
>> IPP System (e.g.: needed to send the Get-Printers request). I cannot find
>> any references to oauth authorization in the document "IPP System Service
>> v1.0 (SYSTEM)". Is there any plan to describe oauth authentication on the
>> level of IPP System?
>>
>> OAuth happens at the HTTP level, so the IPP Authentication Methods v1.0
>> document applies to all IPP services, not just printing.
>>
>> ________________________
>> Michael Sweet
>>
>>
>>

---

From: "Kennedy, Smith \(Wireless & IPP Standards\) via ipp" <[email-masked]>
Date: Fri, 9 Oct 2020 17:08:47 +0000

Hi Piotr,

> On Oct 9, 2020, at 10:48 AM, Piotr Pawliczek <[email-masked]> wrote:
> 
> Hi Smith,
> 
> BTW, have you considered using an HTTP response header (see https://tools.ietf.org/html/rfc6750#section-3 <https://tools.ietf.org/html/rfc6750#section-3>) to communicate "server-uri" and "scope" to the client?
> In this case, we would not have to expose Get-System-Attributes and Get-Printer-Attributes to everyone.

(I've attached a PDF rendering of the PlantUML sequence diagram used to produce figure 4.6 "Sequence diagram for the 'oauth' IPP Authentication Method" from page 19 of 5199.10 to this reply.)

Hmmm, so you are suggesting that the response in edge 11 could provide the same values that are provided via the IPP "oauth-authorization-server-uri" and "oauth-authorization-scope" Printer Description attributes mentioned in the label for edge 13?

Feel free to mark up that PDF and reply to help illustrate what you are trying to suggest if I'm off the mark.

---

From: "Kennedy, Smith \(Wireless & IPP Standards\) via ipp" <[email-masked]>
Date: Fri, 9 Oct 2020 17:15:46 +0000

Eek, out-of-date PDF rendering attached earlier. Please refer to and use the up-to-date one attached instead.

Smith

> On Oct 9, 2020, at 11:08 AM, Kennedy, Smith (Wireless & IPP Standards) via ipp <[email-masked]> wrote:
> 
> Hi Piotr,
> 
>> On Oct 9, 2020, at 10:48 AM, Piotr Pawliczek <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> Hi Smith,
>> 
> <ipp-authentication-6-http-oauth2.pdf><signature.asc>

---

From: Michael Sweet via ipp <[email-masked]>
Date: Fri, 9 Oct 2020 16:40:32 -0400

Piotr,

> On Oct 9, 2020, at 12:48 PM, Piotr Pawliczek <[email-masked]> wrote:
> 
> Hi Smith,
> 
> BTW, have you considered using an HTTP response header (see https://tools.ietf.org/html/rfc6750#section-3) to communicate "server-uri" and "scope" to the client?

"server-uri" is not a registered parameter for the Bearer authentication scheme.

> In this case, we would not have to expose Get-System-Attributes and Get-Printer-Attributes to everyone.

These are already exposed to everything - the OAuth server isn't the only bit of information needed.

> 
> Best regards,
> Piotr 
> 
> On Wed, Oct 7, 2020 at 2:14 PM Kennedy, Smith (Wireless & IPP Standards) <[email-masked]> wrote:
> Hi Piotr,
> 
>> On Wed, Oct 7, 2020 at 1:51 PM Kennedy, Smith (Wireless & IPP Standards) <[email-masked]> wrote:
>> Hi there,
>> 

________________________
Michael Sweet

---

From: Piotr Pawliczek via ipp <[email-masked]>
Date: Fri, 9 Oct 2020 16:30:44 -0700

Hi Mike, Smith,

Yes, "server-uri" is not a registered parameter for the Bearer
authentication scheme.
But if "server-uri" and "scope" were reported in HTTP 401 Response (edge
11), Get-System-Attributes and Get-Printer-Attributes could be protected by
OAuth as other requests.
It would be nice to have this as an option. For public
services, Get-System-Attributes and Get-Printer-Attributes are good targets
for DDos attacks. It is much easier to compose a 401 HTTP response than a
full IPP frame with hundreds of attributes.

Best regards,
Piotr

On Fri, Oct 9, 2020 at 1:40 PM Michael Sweet <[email-masked]> wrote:

> https://tools.ietf.org/html/rfc6750#section-3) to communicate
> "server-uri" and "scope" to the client?
>
> >> But if the System is allowed to respond with an authentication
> challenge (similar to Get-User-Printer-Attributes but not similar to
> >>> > I am trying to figure out how to implement oauth authentication for
> the IPP System (e.g.: needed to send the Get-Printers request). I cannot
> find any references to oauth authorization in the document "IPP System
> Service v1.0 (SYSTEM)". Is there any plan to describe oauth authentication
> on the level of IPP System?
> >>>
> >>> OAuth happens at the HTTP level, so the IPP Authentication Methods
> v1.0 document applies to all IPP services, not just printing.
> >>>
> >>> ________________________
> >>> Michael Sweet
> >>>
> >>>
> >>>