Subject: [OAUTH-WG] Token Exchange status and Resource Indicators

From: Emond Papegaaij <[email-masked]>
Date: Fri, 03 May 2019 17:38:35 +0200

Hi all,

For the application I work on, Topicus KeyHub, we are investigating 'OAuth 2.0 
Token Exchange'. We want to use this protocol to exchange an access token for 
a SAML assertion for signing in to AWS (see below). However, I noticed that 
draft 16 has expired on April 22, 2019. Is this specification still active?

While looking at the specification I noticed a partial overlap with 'Resource 
Indicators for OAuth 2.0'. Both specify the 'resource' parameter on the token 
endpoint. However, Token Exchange adds to this the 'audience' parameter. In my 
opinion it would make sense to align these specs and add the 'audience' 
parameter to 'Resource Indicators'. 'Token Exchange' could then continue to 
build on the 'Resource Indicators' spec rather than redefining these 
parameters.

The specific use case I have in mind is acquiring a SAML assertion for AWS on 
the command line, using the following steps:

Our CLI starts with the device authorization grant. In the device+ 
authorization request, it passes 'audience=urn:amazon:webservices', which is 
the entity ID for AWS. I could use 'resource' here, but I think 'audience' is 
more appropriate.

Next, the user will continue the authentication and will be prompted for 
consent with signing a token for AWS. The resulting access token will be 
audience restricted to AWS.

Finally, the CLI will exchange this token for a SAML assertion for AWS. I can 
again pass the desired audience, but as it is already encoded in the token, 
this is optional. This assertion can then be passed to AWS to complete the 
sign-in.

To summarize, I have to following questions:
 - Is the 'OAuth 2.0 Token Exchange' specification still active?
 - Can 'audience' be added to 'Resource Indicators for OAuth 2.0'?
 - Can 'OAuth 2.0 Token Exchange' be updated to build on 'Resource Indicators 
for OAuth 2.0' rather than redefining the same parameters?

Best regards,
Emond Papegaaij
Topicus KeyHub

---

From: Brian Campbell <[email-masked]>
Date: Sun, 5 May 2019 07:54:48 -0600

On Fri, May 3, 2019 at 9:39 AM Emond Papegaaij <[email-masked]>
wrote:

> [...] we are investigating 'OAuth 2.0
> Token Exchange'. [...] However, I noticed that

Yeah, it is. A nontrivial amount of stuff came up in IESG balloting on the
document
https://datatracker.ietf.org/doc/draft-ietf-oauth-token-exchange/ballot/
and I have not been able to find the time to make all the necessary
changes. Also, resulting from that IESG balloting there was the need to
request early IANA registrations of some things, which is a whole ordeal
unto itself with timelines I cannot seem to affect much even when I have
the time to try. So it's active but just hung up for a moment at the
moment.

>  - Is the 'OAuth 2.0 Token Exchange' specification still active?

Yes with the caveats mentioned above. I will say that although there's a
lot of work required for the document, none of it is likely to result in
functional changes so I don't anticipate anything breaking at this point.

No, that's beyond it's current scope. And it is well past last call in the
WG. But note that a logical identifier can be used as the value of the
resource parameter.

 - Can 'OAuth 2.0 Token Exchange' be updated to build on 'Resource
> Indicators

Not really as a matter of timing and process. But the resource parameter
will ultimately be consistent across the two.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Emond Papegaaij <[email-masked]>
Date: Mon, 06 May 2019 21:47:29 +0200

> functional changes so I don't anticipate anything breaking at this point.

Good to hear, because IMHO it really adds value to OAuth 2.0.

> WG. But note that a logical identifier can be used as the value of the

Would you recommend to put the AWS entity id in the resource parameter on the 
authorize request then? I need a way to inform the authorization server that 
the client wants a token for a different service to allow the authorization 
server to prompt the user for correct consent.

I like the 'audience' parameter defined by the token exchange specification, 
because it really fits the purpose I'm looking for. However, I also like to 
keep the authorization request and token request similar. It looks wrong to 
ask for authorization for 'resource' X and later on request a token for 
'audience' X.

Best regards,
Emond Papegaaij

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 7 May 2019 13:03:00 +0000

> No, that's beyond it's current scope. And it is well past last call in
> the WG. But note that a logical identifier can be used as the value of
> the resource parameter.

The group can define what is in scope of a document and what isn't.

I personally think that we should at least talking about the audience parameter in the resource indicator draft and pointing to the token exchange draft makes a lot of sense because there is a strong relationship between the two.

Deployments are likely to use a mixture of resource and audience depending on whether they want to express the target service as an absolute URI or a logical name.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Brian Campbell <[email-masked]>
Date: Tue, 7 May 2019 11:15:34 -0600

> The group can define what is in scope of a document and what isn't.

Which is what's been done with the document during the course of it's
development and WGLC and subsequent submission to the IESG for publication.

---

From: Emond Papegaaij <[email-masked]>
Date: Thu, 09 May 2019 10:03:52 +0200

(reposting this to the list, due to an error on my part the mail got sent 
privately)
> > > the WG. But note that a logical identifier can be used as the value
> > > of the resource parameter.
> > 
> > Would you recommend to put the AWS entity id in the resource parameter
> > on the authorize request then?
> 
> Yeah, that seems reasonable.

The more I think about this solution, the more I get convinced it is not going 
to work in the general case. The main problem in this is that the resource 
parameter has a strict format: it MUST be an absolute URI. This works for SAML 
entity id's and OIDC issuers, but it will not work in the general form of a 
client identifier. Many of the client identifiers we use are UUIDs. There is no 
way to put this in the resource parameter on the authorize request. The 
library we use to implement our OAuth2 endpoints is very strict in this.

Best regards,
Emond Papegaaij