Subject: [Ace] Access token question

From: Francesca Palombini <[email-masked]>
Date: Fri, 21 Feb 2020 12:37:18 +0000

Hi,

Quick question regarding access token and scope.
I know that “scope” semantics is left to the application to define, but in general I would expect to include there some information about resource and method/operations allowed on that resource. Please correct me if any of this is not exact.

It was my understanding that “scope” (or more precisely the “scope” value) defined for the Client-AS request and response should be included in the access token as well. Checking in CWT, there is no such “scope” claim defined. “aud” claim is indeed defined for the CWT, but that should correspond to “aud” parameter in the ACE request/response. So where do I put the exact resource and operations in the access token?

What am I missing?

Francesca

---

From: Jim Schaad <[email-masked]>
Date: Fri, 21 Feb 2020 09:15:13 -0800

You are missing something

https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-33#section-8.13

defined here

From: Francesca Palombini <[email-masked]> 
Sent: Friday, February 21, 2020 4:37 AM
To: Seitz Ludwig <[email-masked]>; Mike Jones <[email-masked]>; Jim Schaad <[email-masked]>
Cc: Ace Wg <[email-masked]>
Subject: Access token question

Hi,

What am I missing?

Francesca

---

From: Mike Jones <[email-masked]>
Date: Fri, 21 Feb 2020 18:45:26 +0000

And https://tools.ietf.org/html/rfc8693#section-7.4, which registers “scope” at https://www.iana.org/assignments/jwt/jwt.xhtml.

                                                                -- Mike

From: Jim Schaad <[email-masked]>
Sent: Friday, February 21, 2020 9:15 AM
To: 'Francesca Palombini' <[email-masked]>; 'Seitz Ludwig' <[email-masked]>; Mike Jones <[email-masked]>
Cc: 'Ace Wg' <[email-masked]>
Subject: [EXTERNAL] RE: Access token question

https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-33#section-8.13<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-33%23section-8.13&data=02%7C01%7CMichael.Jones%40microsoft.com%7C41e26bbcdb7c4f902d7908d7b6f1a860%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637179021340478864&sdata=bMozqI2BYqMAAViWLIIKzJBvQFa30eqKVHtqUiC3bH8%3D&reserved=0>

defined here

From: Francesca Palombini <[email-masked]<mailto:[email-masked]>>
Sent: Friday, February 21, 2020 4:37 AM
To: Seitz Ludwig <[email-masked]<mailto:[email-masked]>>; Mike Jones <[email-masked]<mailto:[email-masked]>>; Jim Schaad <[email-masked]<mailto:[email-masked]>>
Cc: Ace Wg <[email-masked]<mailto:[email-masked]>>
Subject: Access token question

Hi,

What am I missing?

Francesca

---

From: Francesca Palombini <[email-masked]>
Date: Mon, 24 Feb 2020 07:54:59 +0000

Thanks all! Section 8.13 of the framework is exactly what I was looking for, I don’t know how I did not see it. A bit surprised there is no text referencing it in the framework itself.

Also, about the “scope” claim registration: the claim description and the specification document give 2 different pointers. The claim description ref points to the description for JWT (JSON string etc), I think this should be adapted to using CBOR (writing a section in the ACE framework, which could then reference both pointers). Also minor, I would add the precise section of 6749 we should look at, which I assume is 3.3.

Francesca

From: Mike Jones <[email-masked]>
Date: Friday, 21 February 2020 at 19:45
To: Jim Schaad <[email-masked]>, Francesca Palombini <[email-masked]>, 'Seitz Ludwig' <[email-masked]>
Cc: Ace Wg <[email-masked]>
Subject: RE: [EXTERNAL] RE: Access token question

                                                                -- Mike

https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-33#section-8.13<https://protect2.fireeye.com/v1/url?k=72002d7d-2ed426d6-72006de6-864b0d136b87-400f082a818228df&q=1&e=a5d76c10-357e-4834-9e8c-56996a757268&u=https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Ftools.ietf.org%252Fhtml%252Fdraft-ietf-ace-oauth-authz-33%2523section-8.13%26data%3D02%257C01%257CMichael.Jones%2540microsoft.com%257C41e26bbcdb7c4f902d7908d7b6f1a860%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637179021340478864%26sdata%3DbMozqI2BYqMAAViWLIIKzJBvQFa30eqKVHtqUiC3bH8%253D%26reserved%3D0>

defined here

Hi,

What am I missing?

Francesca

---

From: Jim Schaad <[email-masked]>
Date: Mon, 24 Feb 2020 09:04:02 -0800

I have found that I had to put a scope encoding format into my database for each audience definition.  Just saying that the scope is CBOR is not going to be sufficient, just like saying that it is a text string is not enough.

For the text string side you have:

*	It is a text string
*	It is a text string with space separated values
*	It is a text string with space separated values and each value has an underscore which separates operation and resource (MQTT)

On the binary side you have:

*	The proposal from Carsten that has not get adopted anywhere yet.
*	The group communication format (roughly based on the above format)

There is a question about how all of the binary values are going to work if you do a JSON encoded request rather than a CBOR encoded request.  At the moment, I am assuming that the binary value is encoded (in CBOR) and then base64url encoded and placed in the JSON.  I am not sure if people are going to want to define this as being native JSON instead depending on how the fields of the binary format are encoded.

Given all of this, I don’t know if adding something to the framework is going to be generally useful or not.  So much of what a scope looks like is going to be application dependent.  With any luck we are going to be able to get a good set of scope definitions at some point in the near future and can produce a survey document.  I am not holding my breath on this yet.

Jim

From: Francesca Palombini <[email-masked]> 
Sent: Sunday, February 23, 2020 11:55 PM
To: Mike Jones <[email-masked]>; Jim Schaad <[email-masked]>; 'Seitz Ludwig' <[email-masked]>
Cc: 'Ace Wg' <[email-masked]>
Subject: Re: [EXTERNAL] RE: Access token question

Francesca

From: Mike Jones <[email-masked] <mailto:[email-masked]> >
Date: Friday, 21 February 2020 at 19:45
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >, Francesca Palombini <[email-masked]>, 'Seitz Ludwig' <[email-masked] <mailto:[email-masked]> >
Cc: Ace Wg <[email-masked] <mailto:[email-masked]> >
Subject: RE: [EXTERNAL] RE: Access token question

                                                                -- Mike

From: Jim Schaad <[email-masked] <mailto:[email-masked]> > 
Sent: Friday, February 21, 2020 9:15 AM
To: 'Francesca Palombini' <[email-masked] <mailto:[email-masked]> >; 'Seitz Ludwig' <[email-masked] <mailto:[email-masked]> >; Mike Jones <[email-masked] <mailto:[email-masked]> >
Cc: 'Ace Wg' <[email-masked] <mailto:[email-masked]> >
Subject: [EXTERNAL] RE: Access token question

defined here

From: Francesca Palombini <[email-masked] <mailto:[email-masked]> > 
Sent: Friday, February 21, 2020 4:37 AM
To: Seitz Ludwig <[email-masked] <mailto:[email-masked]> >; Mike Jones <[email-masked] <mailto:[email-masked]> >; Jim Schaad <[email-masked] <mailto:[email-masked]> >
Cc: Ace Wg <[email-masked] <mailto:[email-masked]> >
Subject: Access token question

Hi,

What am I missing?

Francesca

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 24 Feb 2020 21:14:50 +0100

On 2020-02-24, at 18:04, Jim Schaad <[email-masked]> wrote:
> 
> 	• The proposal from Carsten that has not get adopted anywhere yet.

Well, not adopted in the literal sense, but it has been used as a blueprint both in research works and in standardization.

The main question that is holding this back from being a more complete solution is how to represent authorization that is dependent on request parameters (in particular, in bodies, both FETCH and POST/PATCH).
Maybe that is too hard to do in a generic way, and AIF should focus on providing a placeholder for profile specific information about request body handling.

(I have taken the opportunity to resubmit AIF with updated references: 

https://datatracker.ietf.org/doc/draft-bormann-core-ace-aif/
.)

Grüße, Carsten