On Nov 12, 2021, at 8:30 AM, Dmitry Telegin <dmit...@backbase.com> wrote: > > Just to make sure I understand the process, is it going to be something like > draft-XXXXXX-oauth-mtls-rfc8705-bis -> draft-ietf-oauth-mtls-rfc8705-bis -> > new RFC that will obsolete the current one? CCing my colleague Takashi > Norimatsu who worked on MTLS holder-of-key for Keycloak, perhaps he has more > ideas for improvements. >
That’s the most likely path if it happens, yes. And that’s if the WG wants to make that change, which would break things. > As for this stance: > The MTLS draft also re-uses “Bearer” as a token header, which is also a > mistake in my opinion. > > Did you mean the re-use of the "Bearer" scheme for the Authorization header > and WWW-Authenticate challenge? If so, and if we decide to introduce a new > scheme, I think this would imply a new value for the "token_type" token > response attribute as well. > I actually meant the use in the “Authorization: Bearer <token>” header, as well as the token type. In my opinion both of those should be something other than “bearer” because it’s not a bearer token, it’s TLS bound. The argument in the WG at the time was that it would allow easier upgrades from existing implementations. I personally hold that this decision allows for more dangerous downgrades instead. 🤷♀️ — Justin > Of particular interest to me is the question whether different binding > mechanisms (DPoP, MTLS) could co-exist, or should they be mutually exclusive; > this deserves a separate thread though. > > - Dmitry > > On Thu, Nov 11, 2021 at 10:22 AM Justin Richer <jric...@mit.edu > <mailto:jric...@mit.edu>> wrote: > Only if this working group wanted to take up the work of making a new > revision of the standard, but I haven't seen any indication of desire to do > that here. One possibility is for you to propose an update as an individual > draft to the group here. > > -Justin > ________________________________________ > From: Dmitry Telegin [dmit...@backbase.com <mailto:dmit...@backbase.com>] > Sent: Wednesday, November 10, 2021 1:34 PM > To: Justin Richer > Cc: oauth > Subject: Re: [OAUTH-WG] RFC 8705 (oauth-mtls): RS error code for missing > client certificate > > Thanks for the reply. That makes sense. > > Given that MTLS is not a draft but rather a proposed standard (RFC 8705), do > you think there is a chance the changes you proposed could land in MTLS one > day? > > On Wed, Nov 10, 2021 at 6:24 PM Justin Richer <jric...@mit.edu > <mailto:jric...@mit.edu><mailto:jric...@mit.edu <mailto:jric...@mit.edu>>> > wrote: > This is just my interpretation, but this feels more like invalid token, > because you’re not presenting all of the material required for the token > itself. The DPoP draft has added “invalid_dpop_proof” as an error code, which > I think is even better, but the MTLS draft is missing such an element and > that is arguably a mistake in the document. The MTLS draft also re-uses > “Bearer” as a token header, which is also a mistake in my opinion. > > But given the codes available, “invalid_token” seems to fit better because > you aren’t messing up the request _to the resource_ itself, you’re messing up > the token presentation. > > — Justin > > On Nov 10, 2021, at 10:17 AM, Dmitry Telegin > <dmitryt=40backbase....@dmarc.ietf.org > <mailto:40backbase....@dmarc.ietf.org><mailto:dmitryt > <mailto:dmitryt>=40backbase....@dmarc.ietf.org > <mailto:40backbase....@dmarc.ietf.org>>> wrote: > > Any updates on this one? The missing certificate case looks more like > "invalid_request" to me: > > > invalid_request > The request is missing a required parameter, includes an > unsupported parameter or parameter value, repeats the same > parameter, uses more than one method for including an access > token, or is otherwise malformed. The resource server SHOULD > respond with the HTTP 400 (Bad Request) status code. > > > On Fri, Sep 24, 2021 at 2:23 AM Dmitry Telegin <dmit...@backbase.com > <mailto:dmit...@backbase.com><mailto:dmit...@backbase.com > <mailto:dmit...@backbase.com>>> wrote: > From the document: > > > The protected resource MUST obtain, from its TLS implementation > layer, the client certificate used for mutual TLS and MUST verify > that the certificate matches the certificate associated with the > access token. If they do not match, the resource access attempt MUST > be rejected with an error, per > [RFC6750<https://datatracker.ietf.org/doc/html/rfc6750 > <https://datatracker.ietf.org/doc/html/rfc6750>>], using an HTTP 401 status > code and the "invalid_token" error code. > > Should the same error code be used in the case when the resource failed to > obtain a certificate from the TLS layer? This could happen, for example, if > the TLS stack has been misconfigured (e.g. verify-client="REQUESTED" instead > of "REQUIRED" for Undertow), and the user agent provided no certificate. > > Thanks, > Dmitry > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org <mailto:OAuth@ietf.org><mailto:OAuth@ietf.org > <mailto:OAuth@ietf.org>> > https://www.ietf.org/mailman/listinfo/oauth > <https://www.ietf.org/mailman/listinfo/oauth> >
_______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth