Subject: [jose] OpenID Connect specs being reviewed as Implementer's Drafts

From: Mike Jones <[email-masked]>
Date: Mon, 26 Dec 2011 21:40:04 +0000

FYI, the OpenID Connect<http://openid.net/connect/> specs began a 45 day public review period for adoption as Implementer's Drafts last week.  An Implementer's Drafts is a stable draft that is not yet final, but that is intended for implementation, evaluation, and trial deployment.  Intellectual property protections are granted to implementers for these drafts as well.

These drafts can be thought of as a profile of the JOSE and OAuth 2.0 specs that enables single-sign-on and exchange of claims through the use of JSON and JWT.  They use these JOSE- and OAuth-related specs:

JSON Web Signature (JWS)
JSON Web Encryption (JWE)
JSON Web Key (JWK)
JSON Web Token (JWT)
OAuth 2.0 Core
OAuth 2.0 Bearer
OAuth 2.0 Assertions
OAuth 2.0 JWT Assertions Profile
OAuth 2.0 Threat Model
Simple Web Discovery (SWD)

See these pages for more details:
http://openid.net/2011/12/23/review-of-proposed-openid-connect-implementer%e2%80%99s-drafts/
http://self-issued.info/?p=619

                                                            -- Mike

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 26 Dec 2011 16:14:41 -0800

What is going to happen to this if the JOSE makes an incompatible change to
the specifications so that the current profiles will not work?

Jim

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike
Jones
Sent: Monday, December 26, 2011 1:40 PM
To: [email-masked]
Subject: [jose] OpenID Connect specs being reviewed as Implementer's Drafts

FYI, the OpenID Connect <http://openid.net/connect/>  specs began a 45 day
public review period for adoption as Implementer's Drafts last week.  An
Implementer's Drafts is a stable draft that is not yet final, but that is
intended for implementation, evaluation, and trial deployment.  Intellectual
property protections are granted to implementers for these drafts as well.

These drafts can be thought of as a profile of the JOSE and OAuth 2.0 specs
that enables single-sign-on and exchange of claims through the use of JSON
and JWT.  They use these JOSE- and OAuth-related specs:

JSON Web Signature (JWS)

JSON Web Key (JWK)

JSON Web Token (JWT)

OAuth 2.0 Core

OAuth 2.0 Bearer

OAuth 2.0 Assertions

OAuth 2.0 Threat Model

http://openid.net/2011/12/23/review-of-proposed-openid-connect-implementer%e
2%80%99s-drafts/

                                                            -- Mike

---

From: Mike Jones <[email-masked]>
Date: Tue, 27 Dec 2011 00:37:20 +0000

Should that happen, that will be decision for the OpenID Connect working group to make.  They could continue referencing the existing drafts if the incompatibilities are considered unacceptable or they could update the Connect specs to reference the updated IETF drafts if the changes are considered beneficial.  Remember too, that these OpenID specs are implementer's drafts - not final specs.  There will still be the opportunity to make (hopefully very limited) incompatible changes to them before the final specs are approved.  If JOSE accomplishes what it plans to on its target timeline, I see no reason the final OpenID Connect specs can't be referencing final or near-final JOSE specs.  (I'll certainly be working towards that goal, in any event.)

Speaking only as an individual, one potentially incompatible change that I suspect the OpenID community would welcome would be adding the option of enabling integrity protection for encryption operations when using non-AEAD algorithms (as discussed in the open issues portion of the working group presentation in Taipei).  This could potentially simplify (and make more compact) operations that currently must be accomplished using nested signing and encryption steps, when needed.

                                                            Cheers,
                                                            -- Mike

From: Jim Schaad [mailto:[email-masked]]
Sent: Monday, December 26, 2011 4:15 PM
To: Mike Jones; [email-masked]
Subject: RE: [jose] OpenID Connect specs being reviewed as Implementer's Drafts

What is going to happen to this if the JOSE makes an incompatible change to the specifications so that the current profiles will not work?

Jim

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Mike Jones
Sent: Monday, December 26, 2011 1:40 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] OpenID Connect specs being reviewed as Implementer's Drafts

JSON Web Signature (JWS)

                                                            -- Mike

---

From: John Bradley <[email-masked]>
Date: Mon, 26 Dec 2011 22:37:25 -0300

I agree with Mike.  

The implementors draft of Connect can't wait for JOSE to be finalized.

We did try to keep signing and encryption as referenced to the current drafts rather than baking everything in.

Once JOSE and JWT are complete Connect can be updated to reference them.

I do hope for changes to encryption.

It is sometimes awkward to work on interrelated specs in different places,  we have to do the best we can.

John B.
On 2011-12-26, at 9:37 PM, Mike Jones wrote:

> Should that happen, that will be decision for the OpenID Connect working group to make.  They could continue referencing the existing drafts if the incompatibilities are considered unacceptable or they could update the Connect specs to reference the updated IETF drafts if the changes are considered beneficial.  Remember too, that these OpenID specs are implementer’s drafts – not final specs.  There will still be the opportunity to make (hopefully very limited) incompatible changes to them before the final specs are approved.  If JOSE accomplishes what it plans to on its target timeline, I see no reason the final OpenID Connect specs can’t be referencing final or near-final JOSE specs.  (I’ll certainly be working towards that goal, in any event.)
>  
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
> FYI, the OpenID Connect specs began a 45 day public review period for adoption as Implementer’s Drafts last week.  An Implementer’s Drafts is a stable draft that is not yet final, but that is intended for implementation, evaluation, and trial deployment.  Intellectual property protections are granted to implementers for these drafts as well.
>  
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose