Subject: Re: [OAUTH-WG] Working Group Last Call on "Authentication Method Reference Values"

From: Mike Jones <[email-masked]>
Date: Fri, 2 Sep 2016 23:20:19 +0000

Thanks for your question, Vladimir.  No, there is not currently an X.509-specific value defined.  However, there are these related values:

   hwk
      Proof-of-possession (PoP) of a hardware-secured key.  See
      Appendix C of [RFC4211] for a discussion on PoP.

   swk
      Proof-of-possession (PoP) of a software-secured key.  See
      Appendix C of [RFC4211] for a discussion on PoP.

Given that x.509 authentication is PoP authentication, these might apply, depending upon your use case.  Are you using an X.509 "amr" value in practice?  Remember that even if such a value isn't already in use now, if it is ever need in the future, it can always be added later via the registry established by this specification.

				Thanks again,
				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Vladimir Dzhuvinov
Sent: Wednesday, July 27, 2016 8:14 AM
To: [email-masked]
Subject: Re: [OAUTH-WG] Working Group Last Call on "Authentication Method Reference Values"

On 18/07/16 17:30, Hannes Tschofenig wrote:
> Hi all,
>
> this is a Last Call for comments on the "Authentication Method 
> Reference Values" specification.
>
> The document can be found here:
> https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01
>
> Please have your comments in no later than August 1st.
Thanks Hannes.

Do we have an "amr" value for x.509 certificate based authentication?

> Ciao
> Hannes & Derek

--
Vladimir Dzhuvinov

---

From: Mike Jones <[email-masked]>
Date: Fri, 2 Sep 2016 23:55:20 +0000

Thanks for your review, William.  Draft -02 will address these comments as follows:

1.  Added section number, as suggested.

2.  Moved copy of “amr” definition into Introduction, separating it from the Values section.  I agree that that makes the specification more readable.

                                                                Thanks again,
                                                                -- Mike

From: OAuth [mailto:[email-masked]] On Behalf Of William Denniss
Sent: Thursday, July 21, 2016 6:04 AM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Working Group Last Call on "Authentication Method Reference Values"

I'm glad to see this document in working group last call.  The amr values my team is using in our implementation are included.

I have reviewed the 01 version of this draft, and I believe is ready to become an RFC.

I have only two minor editorial comments:

1.
Where we reference the claim in Connect (amr draft section 2), we should also state the specific section, i.e. "is defined by Section 2.0 of the OpenID Connect Core 1.0 specification".

2.
I found the juxtaposition of the amr claim definition and the values a little confusing, as the former is re-stating an existing definition while the latter is new material provided by this spec. I'm glad to see the claim definition in this draft, as it helps to provide context, but I might restructure into two sections, as below (green text added/changed).  If restructured in this way, section 2 would provide the background and section 3 would provide the new material, making it easier to reference from other documents.

---

2<https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01#section-2>.  Authentication Method Reference Claim

   The "amr" (Authentication Methods References) claim is defined by section 2.0 of the

   OpenID Connect Core 1.0 specification [OpenID.Core<https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01#ref-OpenID.Core>] as follows:

   amr

      OPTIONAL.  Authentication Methods References.  JSON array of

      strings that are identifiers for authentication methods used in

      the authentication.  For instance, values might indicate that both

      password and OTP authentication methods were used.  The definition

      of particular values to be used in the "amr" Claim is beyond the

      scope of this specification.  Parties using this claim will need

      to agree upon the meanings of the values used, which may be

      context-specific.  The "amr" value is an array of case sensitive

      strings.

   OpenID Connect does not specify any particular

   Authentication Method Reference values to be used in the "amr" claim.

   This specification establishes a registry for these values and defines a starting list.

3.  Authentication Method Reference Values

   The following is a list of Authentication Method Reference values

   defined by this specification:

On Mon, Jul 18, 2016 at 4:30 PM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

this is a Last Call for comments on the "Authentication Method Reference
Values" specification.

Ciao
Hannes & Derek

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Thu, 8 Sep 2016 10:10:25 +0200

Thanks Mike, "hwk" and "swk" would do. The actual auth method is indeed
proving key possession, whereas x.509 is mostly about formatting.

Vladimir

-- 
Vladimir Dzhuvinov :: [email-masked]