Yes, this I agree with. This is why I think we should probably have:

        Authorization: Bearer foo...
        Authorization: DPoP foo...
        Authorization: HTTPSig foo...
        Authorization: MTLS foo…

And so on. If you’ve got a middle box that’s adding its own attestations to the 
request, that’s not adding additional presentations to the access token. 

 — Justin

> On Nov 16, 2021, at 6:05 PM, 乗松隆志 / NORIMATSU,TAKASHI 
> <takashi.norimatsu...@hitachi.com> wrote:
> 
> Hello,
>  
> Considering that several technologies has emerged for realizing sender 
> constrained tokens (e.g. holder-of-key bound : certificate bound by MTLS, 
> DPoP, etc ... in the future), it might be good to show which kind of 
> technology is used for sender constraint token explicitly with Authentication 
> header value if there is a chance that RS allows several technologies for 
> sender constrained access token.
>  
> Regards,
> Takashi Norimatsu
> Hitachi, Ltd.
>  
> From: Justin Richer <jric...@mit.edu> 
> Sent: Tuesday, November 16, 2021 1:18 AM
> To: Dmitry Telegin <dmit...@backbase.com>
> Cc: oauth <oauth@ietf.org>; 乗松隆志 / NORIMATSU,TAKASHI 
> <takashi.norimatsu...@hitachi.com>
> Subject: [!]Re: [OAUTH-WG] RFC 8705 (oauth-mtls): RS error code for missing 
> client certificate
>  
> On Nov 12, 2021, at 8:30 AM, Dmitry Telegin <dmit...@backbase.com 
> <mailto:dmit...@backbase.com>> wrote:
>  
> Just to make sure I understand the process, is it going to be something like 
> draft-XXXXXX-oauth-mtls-rfc8705-bis -> draft-ietf-oauth-mtls-rfc8705-bis -> 
> new RFC that will obsolete the current one? CCing my colleague Takashi 
> Norimatsu who worked on MTLS holder-of-key for Keycloak, perhaps he has more 
> ideas for improvements.
>  
>  
> That’s the most likely path if it happens, yes. And that’s if the WG wants to 
> make that change, which would break things.
> 
> 
> As for this stance:
> The MTLS draft also re-uses “Bearer” as a token header, which is also a 
> mistake in my opinion.
>  
> Did you mean the re-use of the "Bearer" scheme for the Authorization header 
> and WWW-Authenticate challenge? If so, and if we decide to introduce a new 
> scheme, I think this would imply a new value for the "token_type" token 
> response attribute as well.
>  
>  
> I actually meant the use in the “Authorization: Bearer <token>” header, as 
> well as the token type. In my opinion both of those should be something other 
> than “bearer” because it’s not a bearer token, it’s TLS bound. The argument 
> in the WG at the time was that it would allow easier upgrades from existing 
> implementations. I personally hold that this decision allows for more 
> dangerous downgrades instead. 🤷♀️
>  
>  
> — Justin
>  
> 
> 
> Of particular interest to me is the question whether different binding 
> mechanisms (DPoP, MTLS) could co-exist, or should they be mutually exclusive; 
> this deserves a separate thread though.
>  
> - Dmitry
>  
>  
>  
>  
> On Thu, Nov 11, 2021 at 10:22 AM Justin Richer <jric...@mit.edu 
> <mailto:jric...@mit.edu>> wrote:
> Only if this working group wanted to take up the work of making a new 
> revision of the standard, but I haven't seen any indication of desire to do 
> that here. One possibility is for you to propose an update as an individual 
> draft to the group here. 
> 
> -Justin
> ________________________________________
> From: Dmitry Telegin [dmit...@backbase.com <mailto:dmit...@backbase.com>]
> Sent: Wednesday, November 10, 2021 1:34 PM
> To: Justin Richer
> Cc: oauth
> Subject: Re: [OAUTH-WG] RFC 8705 (oauth-mtls): RS error code for missing 
> client certificate
> 
> Thanks for the reply. That makes sense.
> 
> Given that MTLS is not a draft but rather a proposed standard (RFC 8705), do 
> you think there is a chance the changes you proposed could land in MTLS one 
> day?
> 
> On Wed, Nov 10, 2021 at 6:24 PM Justin Richer <jric...@mit.edu 
> <mailto:jric...@mit.edu><mailto:jric...@mit.edu <mailto:jric...@mit.edu>>> 
> wrote:
> This is just my interpretation, but this feels more like invalid token, 
> because you’re not presenting all of the material required for the token 
> itself. The DPoP draft has added “invalid_dpop_proof” as an error code, which 
> I think is even better, but the MTLS draft is missing such an element and 
> that is arguably a mistake in the document. The MTLS draft also re-uses 
> “Bearer” as a token header, which is also a mistake in my opinion.
> 
> But given the codes available, “invalid_token” seems to fit better because 
> you aren’t messing up the request _to the resource_ itself, you’re messing up 
> the token presentation.
> 
>  — Justin
> 
> On Nov 10, 2021, at 10:17 AM, Dmitry Telegin 
> <dmitryt=40backbase....@dmarc.ietf.org 
> <mailto:40backbase....@dmarc.ietf.org><mailto:dmitryt 
> <mailto:dmitryt>=40backbase....@dmarc.ietf.org 
> <mailto:40backbase....@dmarc.ietf.org>>> wrote:
> 
> Any updates on this one? The missing certificate case looks more like 
> "invalid_request" to me:
> 
> 
> invalid_request
>          The request is missing a required parameter, includes an
>          unsupported parameter or parameter value, repeats the same
>          parameter, uses more than one method for including an access
>          token, or is otherwise malformed.  The resource server SHOULD
>          respond with the HTTP 400 (Bad Request) status code.
> 
> 
> On Fri, Sep 24, 2021 at 2:23 AM Dmitry Telegin <dmit...@backbase.com 
> <mailto:dmit...@backbase.com><mailto:dmit...@backbase.com 
> <mailto:dmit...@backbase.com>>> wrote:
> From the document:
> 
> 
>    The protected resource MUST obtain, from its TLS implementation
>    layer, the client certificate used for mutual TLS and MUST verify
>    that the certificate matches the certificate associated with the
>    access token.  If they do not match, the resource access attempt MUST
>    be rejected with an error, per 
> [RFC6750<https://datatracker.ietf.org/doc/html/rfc6750 
> <https://secure-web.cisco.com/1o_2s-Gspt8sfupLKDuTsMUX0mq2oJBpOmhZGA15-xGMgZFiTepx6JeXQohQQs-Glnj09iZyh6bzIPoQDrizWlLZBsH-6nxwkLrjVuMHBrgVmb0xqFr2O9pc9oRLu2KFZ2VqpLc7Pkf_IxyVbW0CW5OI_dBUr_LFaRcZPhnfQbeXcYZHRMzwtikk1ositkwgcSYqfKsn8uZWaYQipspFXiyB4xgg891fgojvsQuvMi5ZWKELavcBAjh8KQzxhSIHLk0q4XdaUWI325xXswKFR8DW2eFWf2G_LHg2fVEbDayTFBmjpLpm_nuhESWkdHuDH/https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Frfc6750>>],
>  using an HTTP 401 status
>    code and the "invalid_token" error code.
> 
> Should the same error code be used in the case when the resource failed to 
> obtain a certificate from the TLS layer? This could happen, for example, if 
> the TLS stack has been misconfigured (e.g. verify-client="REQUESTED" instead 
> of "REQUIRED" for Undertow), and the user agent provided no certificate.
> 
> Thanks,
> Dmitry
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org <mailto:OAuth@ietf.org><mailto:OAuth@ietf.org 
> <mailto:OAuth@ietf.org>>
> https://www.ietf.org/mailman/listinfo/oauth 
> <https://secure-web.cisco.com/1DcCIzbtbXNIKMHxsgjNGi4azyXC-apZRqf390H1ZxBHQkpGwvQjJIVhO420OXxNCSzpXIvFNgkcV93HKWRmsyNWztAipkXMP4u3UXu4pmv0uXcaK-fyPec9nZTunr_08LsLBX76KocDJk5Wc5DBrwq5yArl6n3HqqsfaLRsSER5VsPcjBjGexgiccHaFhG6NTErbU7WRvY-X8xULLdpL7A-TvykYVndXf73heLo0JZ_fymjUvmMIC3_Seqq34Ta2b5LZRSjClmtcKSi75m2lpaEGrX5C1vGENl7mIH0PaelRR2cqxh7E3HNTwBxxYSe0/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Foauth>
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth

Reply via email to