Comments on draft-ietf-oauth-token-exchange-10
I propose the following rephrasing for sections 6 and 7:
6 . Security Considerations
All of the normal security issues that are discussed in [JWT],especially
in relationship to comparing URIs
and dealing with unrecognized values, also apply here. In addition,
both delegation and impersonation introduce
unique security issues. Any time one user receives a token, the
potential for abuse is a concern,
since that user might be willing to collude with another user so that
other user could use the token.
Techniques like the binding of an access token to a TLS channel
described elsewhere are ineffective since
the legitimate user would be able to perform all the cryptographic
computations that the other user would need
to demonstrate the ownership of the token. The use of the "scp" claim is
suggested to mitigate potential for
such abuse, as it restricts the contexts in which the token can be
exercised. If the issued access token scope
allows to unambiguously identify the user, then that user is likely to
be reluctant to collude with another user.
However, if the issued access token scope only indicates that the user
is over 18, then there is no risk
for the original user to be discovered and in such a context a collusion
may easily take place.
This document does not specify techniques to prevent such a collusion to
be successful.
7 . Privacy Considerations
Tokens typically carry personal information and their usage in Token
Exchange may reveal details of the target services
being accessed. The resource and the audience parameters allow
authorization servers to know where the issued access token
will be used. This may be a privacy concern for some users. This
document does not specify techniques to prevent
authorization servers to know where the access tokens they issue will be
used.
Denis
A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Web Authorization Protocol WG of the IETF.
Title : OAuth 2.0 Token Exchange
Authors : Michael B. Jones
Anthony Nadalin
Brian Campbell
John Bradley
Chuck Mortimore
Filename : draft-ietf-oauth-token-exchange-10.txt
Pages : 32
Date : 2017-11-30
Abstract:
This specification defines a protocol for an HTTP- and JSON- based
Security Token Service (STS) by defining how to request and obtain
security tokens from OAuth 2.0 authorization servers, including
security tokens employing impersonation and delegation.
The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-oauth-token-exchange/
There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-10
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-token-exchange-10
A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-oauth-token-exchange-10
Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.
Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
