Subject: [OAUTH-WG] JSON Payload signature (re: draft-richer-oauth-signed-http-request-01.txt)

From: Phil Hunt <[email-masked]>
Date: Tue, 6 May 2014 15:54:20 -0700

Justin,

Any discussion on including JSON payloads in the signed requests?  Had an interesting conversation with Bill and I think this would be a useful optional feature.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: "Richer, Justin P." <[email-masked]>
Date: Wed, 7 May 2014 00:19:39 +0000

Seems like a reasonable extension to me, in that it shouldn't break things, really. Is the suggestion to define a particular member for "other stuff" or to state that you're allowed to add other stuff inside the payload object?

But on the other hand, I'm wondering why other parts of the protocol (like hashing the HTTP body) wouldn't cover it? Or why you wouldn't want to just use a JOSE container for your entire protocol? Basically, within a given protocol you could easily put whatever additional stuff you like inside the protected JOSE payload without disrupting things, but I don't see the use case why you'd want to do that and not something else.

 -- Justin

On May 6, 2014, at 6:54 PM, Phil Hunt <[email-masked]<mailto:[email-masked]>> wrote:

Justin,

Phil

@independentid
www.independentid.com<http://www.independentid.com/>
[email-masked]<mailto:[email-masked]>

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Phil Hunt <[email-masked]>
Date: Tue, 6 May 2014 17:33:56 -0700

Well...

In the case of scim which takes json requests and gives json responses, it would be nice to have signed transactions including json payload from http body. This could be easily layer on top of scim without required any change to scim. 

If however someone wants a json body like a jwt assertion (where both are in the same json structure) thats a different thing isn't it. :-)

Phil

> On May 6, 2014, at 17:19, "Richer, Justin P." <[email-masked]> wrote:
> 
>> On May 6, 2014, at 6:54 PM, Phil Hunt <[email-masked]> wrote:
>> 
>> Justin,
>> 
>> [email-masked]