Subject: [OAUTH-WG] WGLC on Pushed Authorization Requests draft

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 11 Aug 2020 18:07:43 -0400

All,

This is a WGLC on the *Pushed Authorization Requests *document:
https://www.ietf.org/id/draft-ietf-oauth-par-03.html

Please, take a look and provide feedback on the list by *August 25th.*

Regards,
 Rifaat & Hannes

---

From: Joseph Heenan <[email-masked]>
Date: Thu, 13 Aug 2020 01:07:47 +0100

Thanks Rifaat, Hannes, and also thanks to all the authors.

I’ve been through the latest spec and it basically looks great to me; I raised 3 minor niggles under https://github.com/oauthstuff/draft-oauth-par/issues <https://github.com/oauthstuff/draft-oauth-par/issues>

https://github.com/oauthstuff/draft-oauth-par/issues/59 <https://github.com/oauthstuff/draft-oauth-par/issues/59> - possible ambiguity in the text around error responses from new endpoint

https://github.com/oauthstuff/draft-oauth-par/issues/62 <https://github.com/oauthstuff/draft-oauth-par/issues/62> & https://github.com/oauthstuff/draft-oauth-par/issues/63 <https://github.com/oauthstuff/draft-oauth-par/issues/63> - minor typographical points

For info, Authlete has at least one deployed implementation of this spec.

Authlete has also assisted in getting tests for PAR added to the Open ID Foundation FAPI Certification test suite for Authorization Servers, and (although there’s still a few niggles in the tests to work out) the tests seem to interoperate with Authlete, Filip’s node-oidc-provider and a Ping implementation fine. (Many thanks to Filip & Ping for testing them! If anyone else would like to try them please let me know.)

Thanks

Joseph

> 
> On 11 Aug 2020, at 23:07, Rifaat Shekh-Yusef <[email-masked]> wrote:
> 
> All,
> 
> This is a WGLC on the Pushed Authorization Requests document:
> https://www.ietf.org/id/draft-ietf-oauth-par-03.html <https://www.ietf.org/id/draft-ietf-oauth-par-03.html>
> 
> Please, take a look and provide feedback on the list by August 25th.
> 
> Regards,
>  Rifaat & Hannes
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Tue, 18 Aug 2020 15:18:21 -0600

Thanks Joseph. We'll get those niggles addressed. And it's great to hear
the positive implementation and testing info.

On Wed, Aug 12, 2020 at 6:08 PM Joseph Heenan <[email-masked]> wrote:

> I’ve been through the latest spec and it basically looks great to me; I
> raised 3 minor niggles under
> https://github.com/oauthstuff/draft-oauth-par/issues
>
> https://github.com/oauthstuff/draft-oauth-par/issues/59 - possible
> ambiguity in the text around error responses from new endpoint
>
> https://github.com/oauthstuff/draft-oauth-par/issues/62 &
> https://github.com/oauthstuff/draft-oauth-par/issues/63 - minor
> typographical points
>
>
> Authlete has also assisted in getting tests for PAR added to the Open ID
> Foundation FAPI Certification test suite for Authorization Servers, and
> (although there’s still a few niggles in the tests to work out) the tests
> seem to interoperate with Authlete, Filip’s node-oidc-provider and a Ping
> implementation fine. (Many thanks to Filip & Ping for testing them! If
> anyone else would like to try them please let me know.)
>
> Thanks
>
> Joseph
>
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Brian Campbell <[email-masked]>
Date: Tue, 18 Aug 2020 16:25:10 -0600

A couple of WGLC comments from my sphere.

I'd like to take the discussion of the first item in
https://mailarchive.ietf.org/arch/msg/oauth/iD33QbZTj92LJ6M9wNUq9s3nLpA/ as
a suggestion that the top part of section 2.1
<https://www.ietf.org/id/draft-ietf-oauth-par-03.html#section-2.1> be
reworked or adjusted so as to (hopefully) avoid any confusion that the list
there somehow conveys normative requirements.

The definition of the client require_pushed_authorization_
<https://www.ietf.org/id/draft-ietf-oauth-par-03.html#section-6>requests
metadata parameter
<https://www.ietf.org/id/draft-ietf-oauth-par-03.html#section-6-2.2> needs
to specify a default similar to how the AS metadata parameter of the same
name <https://www.ietf.org/id/draft-ietf-oauth-par-03.html#section-5-2.4>
does - i.e., "If omitted, the default value is false."

---

From: Karsten Meyer zu Selhausen <[email-masked]>
Date: Wed, 19 Aug 2020 11:41:21 +0200

Hi all,

I have two very small suggestions which I also raised as issues on Github:

 1. There are no hints in front of example requests/responses if extra
    line breaks are used for display purposes. I think hints such as
    "(with extra line breaks for display purposes only)" should be added
    to the examples. (#64
    <https://github.com/oauthstuff/draft-oauth-par/issues/64>)
 2. In section 3 there is a typo in step 2. I think it should be
    "*Validate *the request object signature as specified in JAR
    [I-D.ietf-oauth-jwsreq], section 6.2." instead of "*Validates *the
    ...". The imperative is used in step 1, as well. (#65
    <https://github.com/oauthstuff/draft-oauth-par/issues/65>)

Best regards;
Karsten

-- 
Karsten Meyer zu Selhausen
IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:	https://hackmanit.de | IT Security Consulting, Penetration Testing, Security Training

Unsere nächste Live Online-Schulung zur Sicherheit von OAuth und OpenID Connect am 24.09 + 25.09:
https://hackmanit.de/de/schulungen/109-live-online-schulung-single-sign-on-sicherheit-oauth-openid-connect-am-24-und-25-09-2020

Hackmanit GmbH
Universitätsstraße 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Dr. Marcus Niemietz

---

From: Brian Campbell <[email-masked]>
Date: Wed, 19 Aug 2020 13:22:58 -0600

Thanks for the review, Karsten. We'll incorporate your suggestions into the
next revision of the draft.

On Wed, Aug 19, 2020 at 3:41 AM Karsten Meyer zu Selhausen <
[email-masked]> wrote:

>    line breaks are used for display purposes. I think hints such as "(with
>    extra line breaks for display purposes only)" should be added to the
>    examples. (#64
>    2. In section 3 there is a typo in step 2. I think it should be "*Validate
>    *the request object signature as specified in JAR
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
> --
> Unsere nächste Live Online-Schulung zur Sicherheit von OAuth und OpenID Connect am 24.09 + 25.09:https://hackmanit.de/de/schulungen/109-live-online-schulung-single-sign-on-sicherheit-oauth-openid-connect-am-24-und-25-09-2020
>
> Hackmanit GmbH

---

From: Denis <[email-masked]>
Date: Tue, 25 Aug 2020 15:28:24 +0200

This document does not include a "Privacy considerations" section, but 
it should.

Denis