Subject: Re: [OAUTH-WG] New Version Notification for draft-lodderstedt-oauth-jwt-introspection-response-00.txt

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 25 May 2018 11:35:20 +0200

Hi Neil,

> Am 28.03.2018 um 17:41 schrieb Neil Madden <[email-masked]>:
> 
> I like this draft, but I want to clarify if it is intended that the response JWT could be interpreted as an OpenID Connect ID Token? As the set of claims can overlap (in particular, all required ID token claims are valid token introspection response fields) and it seems highly likely that an AS will use the same keys for signing both (and it definitely will when the client_secret is used for signing), the signed response JWT could well be indistinguishable from an ID token (for the resource owner) with some additional claims.

Conceptually, the introspection response, an ID Token and even structured access tokens are quite the same if they carry user identifiers or claims. They identify the respective user account towards RP or RS and provide additional attributes, which, for example, can be used to meet access control decisions. And if JWT is the representation, they are also syntactically (nearly) equivalent. The main difference I see that an ID Token may contain a nonce, which is not required in access tokens. 

> 
> If this is not the case, then maybe consider adding a “crit”: [“scope”] claim to the response (https://tools.ietf.org/html/rfc7515#section-4.1.11) to indicate that the scope claim must be understood.

What do you want to achieve/prevent? 

> 
> I can think of one potential use-case (I’ll let you decide the merits of it) where it might actually be useful to explicitly allow the response to be an ID Token. Consider an application (RS) that uses a traditional authorization model: it authenticates a user, sets a cookie, and then based on who that user is makes dynamic access control decisions to see what they are allowed to do (e.g., ACLs, RBAC, whatever). An easy way to upgrade this app to modern standards would be to replace the home-spun authentication system with OIDC, but leave the rest in place. Now the system uses OIDC to authenticate the user, sets the ID token as the cookie, and then still applies the same access control decisions that it always has done.
> 
> Now imagine that a new requirement comes in to support OAuth 2.0 access tokens to allow delegation to third-party apps. A really simple way to achieve that would be to put a filter/reverse proxy in front of the RS that extracts access tokens coming in, performs signed JWT token introspection against the AS to validate the token and then checks the the scopes are appropriate for the request. It can then simply replace the access token in the original request with the signed token introspection response (as ID token) and forward it on to the original RS server. As the introspection response is a valid ID token for the resource owner, the RS will then apply all its normal access control checks to ensure that the resource owner actually has the permissions that they have delegated to the client.
> 
> I think potentially that is quite an interesting application of this draft, but I don’t think it was intended! I think probably a decision should be made as to whether that kind of usage should be allowed and explicitly adjust the draft to either allow or deny it. If it is allowed, then possibly there should be a way for the caller to hint that they want the response to be a valid ID token.

I don’t currently see a way the introspection response could be abused as ID Token other than the recipient of the response (or an attacker able to obtain the response object) sets up a fake IDP and provides the response as an ID token to a RP. The RP should be able to detect this (as other ways to replay ID tokens) by utilizing the nonce.

kind regards,
Torsten.  

> 
> Kind regards,
> 
> Neil
> 
>> On 18 Mar 2018, at 19:33, Torsten Lodderstedt <[email-masked]> wrote:
>> 
>> Hi all,
>> 
>> I just submitted a new draft that Vladimir Dzhuvinov and I have written. It proposes a JWT-based response type for Token Introspection. The objective is to provide resource servers with signed tokens in case they need cryptographic evidence that the AS created the token (e.g. for liability). 
>> 
>> I will present the new draft in the session on Wednesday.
>> 
>> kind regards,
>> Torsten. 
>> 
>>> Anfang der weitergeleiteten Nachricht:
>>> 
>>> Von: [email-masked]
>>> Betreff: New Version Notification for draft-lodderstedt-oauth-jwt-introspection-response-00.txt
>>> Datum: 18. März 2018 um 20:19:37 MEZ
>>> An: "Vladimir Dzhuvinov" <[email-masked]>, "Torsten Lodderstedt" <[email-masked]>
>>> 
>>> 
>>> A new version of I-D, draft-lodderstedt-oauth-jwt-introspection-response-00.txt
>>> has been successfully submitted by Torsten Lodderstedt and posted to the
>>> IETF repository.
>>> 
>>> Name:		draft-lodderstedt-oauth-jwt-introspection-response
>>> Revision:	00
>>> Title:		JWT Response for OAuth Token Introspection
>>> Document date:	2018-03-15
>>> Group:		Individual Submission
>>> Pages:		5
>>> URL:            https://www.ietf.org/internet-drafts/draft-lodderstedt-oauth-jwt-introspection-response-00.txt
>>> Status:         https://datatracker.ietf.org/doc/draft-lodderstedt-oauth-jwt-introspection-response/
>>> Htmlized:       https://tools.ietf.org/html/draft-lodderstedt-oauth-jwt-introspection-response-00
>>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-lodderstedt-oauth-jwt-introspection-response
>>> 
>>> 
>>> Abstract:
>>>   This draft proposes an additional JSON Web Token (JWT) based response
>>>   for OAuth 2.0 Token Introspection.
>>> 
>>> 
>>> 
>>> 
>>> Please note that it may take a couple of minutes from the time of submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>> 
>>> The IETF Secretariat
>>> 
>> 
>> _______________________________________________
>> OAuth mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 25 May 2018 12:24:36 +0200

HI Petteri,

thanks for your feedback. I incorporated it in the upcoming revision. 

kind regards,
Torsten. 

> Am 26.03.2018 um 11:02 schrieb Petteri Stenius <[email-masked]>:
> 
> Hi all,
>  
> I want to show my support for this proposal
>  
>  
> I believe the two use cases presented at the IETF meeting [1] are important:
>  
> 1. implementing application level end-to-end integrity protection of the introspection response
> 2. simple conversion of by-reference access tokens into by-value JWT encoded tokens
>  
>  
> This proposal adds three fields to the client metadata. I think there are two issues that should be addressed:
>  
> 1. Remove double "response" from field names. Replace "introspection_response_signed_response_alg" with "introspection_signed_response_alg". Also address two other fields
> 2. Add corresponding fields to provider metadata. For client metadata field "introspection_signed_response_alg" there should exist "introspection_signing_alg_values_supported" in provider metadata. The two other fields need corresponding fields as well.
>  
>  
> Relationship with OpenID Connect
>  
> In OpenID Connect the userinfo endpoint is very similar to introspection endpoint of OAuth. Userinfo supports JWT signing and encryption. Adding JWT signing and encryption to introspection endpoint fills the gap between the two specifications.
>  
>  
> Best regards,
> Petteri Stenius
>  
> [1] https://datatracker.ietf.org/meeting/101/materials/slides-101-oauth-sessb-jwt-introspection-response-01
>  
>  
>  
> From: OAuth <[email-masked]> On Behalf Of Torsten Lodderstedt
> Sent: sunnuntai 18. maaliskuuta 2018 21.33
> To: oauth <[email-masked]>
> Subject: [OAUTH-WG] Fwd: New Version Notification for draft-lodderstedt-oauth-jwt-introspection-response-00.txt
>  
> Hi all,
>

---

From: Neil Madden <[email-masked]>
Date: Fri, 25 May 2018 11:49:41 +0100

Hi Torsten,

> On 25 May 2018, at 10:35, Torsten Lodderstedt <[email-masked]> wrote:
> 
> Hi Neil,
> 

Are they the same? An ID token authenticates (claims about) a user to the RP. I don’t think that is the intended interpretation of a token introspection response, and it’s not the purpose of an access token. My point is that as specified they can be syntactically identical and yet intended for different purposes.

> What do you want to achieve/prevent?

The sorts of issues discussed in https://tools.ietf.org/html/draft-ietf-oauth-jwt-bcp-03#section-2.7

As I said in a follow-up email, “crit” does not actually work here as it only applies to headers. If we wanted to distinguish them, we could use explicit typing as recommended in the BCP: https://tools.ietf.org/html/draft-ietf-oauth-jwt-bcp-03#section-3.11 and have a type of “introspection+jwt” or something like that (with an appropriate media type registration).

> I don’t currently see a way the introspection response could be abused as ID Token other than the recipient of the response (or an attacker able to obtain the response object) sets up a fake IDP an…

As a client I can go and get an access token with some scope “a”. I now hit the token introspection endpoint and get back a signed JWT. That signed JWT happens to be syntactically identical to an OIDC ID Token and the AS happens to use the same key to sign both. So now I effectively have an ID Token for that user, although I never requested the “openid” scope. OK, so I don’t have an access token with the right scopes to hit the UserInfo endpoint, and I learn nothing that I could not get from a normal introspection response, but still it feels a bit surprising to me.

Furthermore, as the “aud” claim in the token introspection response is optional, and it has no nonce, I *might* be able to replay this JWT in other situations to other parties. For instance, if I can find an OIDC RP that does not use or validate nonces correctly (they are optional), then I may be able to use it to log in as the user at that other RP.

I don’t think these are huge issues as they depend on RPs already being careless about validation (e.g., ignoring a missing audience claim), but they are the sort of non-obvious interactions between components where security issues often crop up, so I want to ensure the possibility has been considered by the WG and an informed decision made either way.

I would be happy if we just made the “aud” and “iss” claims mandatory in this spec (they are optional in RFC 7662), and require that the protected resource is in the audience.

— Neil

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 27 May 2018 17:25:16 +0200

Hi Neil,

> Am 25.05.2018 um 12:49 schrieb Neil Madden <[email-masked]>:
> 
> Hi Torsten,
> 
> Are they the same? An ID token authenticates (claims about) a user to the RP.

The same definition holds true for access tokens towards RSs.

> I don’t think that is the intended interpretation of a token introspection response, and it’s not the purpose of an access token. My point is that as specified they can be syntactically identical and yet intended for different purposes.

The difference is just the role the party is taking in the overall protocol flow. In my experience, contents of access tokens and contents of ID tokens tend to be rather similar, at least in the consumer identity space. 

> As I said in a follow-up email, “crit” does not actually work here as it only applies to headers. If we wanted to distinguish them, we could use explicit typing as recommended in the BCP: https://t…

The text also states "Note that this is a specific type of substitution attack.“ and I fully agree with this assessment. In my opinion, the consequence is that all the countermeasures available for token substitution can and must be used to detect such misuse. In the particular case of an an attacker wanting to use a token introspection response JWT as ID token in a different flow, all security checks defined by OpenId Connect (http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation) must be performed. This means the RP must, for example, validate issuer, audience and nonce. This should be sufficient to prevent any kind of abuse.

> Furthermore, as the “aud” claim in the token introspection response is optional, and it has no nonce, I *might* be able to replay this JWT in other situations to other parties. For instance, if I c…

Good point. I think that would work for an RP using the id_token (or a hybrid) response type. But the RP MUST validate the aud claim.

> I don’t think these are huge issues as they depend on RPs already being careless about validation (e.g., ignoring a missing audience claim), but they are the sort of non-obvious interactions betwee…

I fully agree. I would like to prevent a situation where somebody believes we need to adopt a different syntax in order to prevent such "Cross-JWT Confusion“ attacks. 

> I would be happy if we just made the “aud” and “iss” claims mandatory in this spec (they are optional in RFC 7662), and require that the protected resource is in the audience.

Makes sense. I will add this to the draft. 

thanks,
Torsten.