will side channels also be available to attend online
", "time": "2022-07-25T14:01:28Z"}, {"author": "George Fletcher", "text": "Yes, they have links in the agenda for the side meetings
", "time": "2022-07-25T14:05:32Z"}, {"author": "George Fletcher", "text": "https://trac.ietf.org/trac/ietf/meeting/wiki/114sidemeetings
", "time": "2022-07-25T14:08:20Z"}, {"author": "Justin Richer", "text": "additional foot-gun: parsing the internal JSON in the claim string.
", "time": "2022-07-25T14:26:27Z"}, {"author": "Justin Richer", "text": "(but that is fixable)
", "time": "2022-07-25T14:26:37Z"}, {"author": "Hirsch Singhal", "text": "re: SD-JWT - the example at the start had parts of the complex object street address redacted (everything but country), but the SVC has the entire street address claim in one value. Is this using a snark-like partial hash? (oh, I see, wait on the slides...)
", "time": "2022-07-25T14:26:42Z"}, {"author": "Justin Richer", "text": "JCS is made out of foot-guns :)
", "time": "2022-07-25T14:32:03Z"}, {"author": "Justin Richer", "text": "right -- why not just send the array?
", "time": "2022-07-25T14:37:02Z"}, {"author": "Benjamin Kaduk", "text": "Who had the question prior to Leif's?
", "time": "2022-07-25T14:37:54Z"}, {"author": "George Fletcher", "text": "I'm in favor of adoption
", "time": "2022-07-25T14:40:08Z"}, {"author": "Justin Richer", "text": "I\"m not raising my hadn for support
", "time": "2022-07-25T14:40:16Z"}, {"author": "Nat Sakimura", "text": "I'm in favour as well
", "time": "2022-07-25T14:40:18Z"}, {"author": "Justin Richer", "text": "I have a question
", "time": "2022-07-25T14:40:18Z"}, {"author": "Justin Richer", "text": "I don't think anyone's watching the chat
", "time": "2022-07-25T14:41:27Z"}, {"author": "George Fletcher", "text": "Maybe not :)
", "time": "2022-07-25T14:41:37Z"}, {"author": "Nat Sakimura", "text": "I am :-)
", "time": "2022-07-25T14:41:50Z"}, {"author": "Nat Sakimura", "text": "(well, from Tokyo)
", "time": "2022-07-25T14:42:07Z"}, {"author": "Jaimandeep Singh", "text": "No audio
", "time": "2022-07-25T14:42:13Z"}, {"author": "Justin Richer", "text": "I mean anyone in the room :)
", "time": "2022-07-25T14:42:17Z"}, {"author": "Nat Sakimura", "text": ":-)
", "time": "2022-07-25T14:42:22Z"}, {"author": "Filip Skokan", "text": "audio went silent
", "time": "2022-07-25T14:42:24Z"}, {"author": "Justin Richer", "text": "@meetecho no audio
", "time": "2022-07-25T14:42:26Z"}, {"author": "Nat Sakimura", "text": "Well, I lost audio
", "time": "2022-07-25T14:42:28Z"}, {"author": "Joseph Heenan", "text": "Me too
", "time": "2022-07-25T14:42:31Z"}, {"author": "Shigeya Suzuki", "text": "me too.
", "time": "2022-07-25T14:42:32Z"}, {"author": "Rolf Sonneveld", "text": "Me too
", "time": "2022-07-25T14:42:34Z"}, {"author": "George Fletcher", "text": "Yeah... me too
", "time": "2022-07-25T14:42:35Z"}, {"author": "Jonas Primbs", "text": "me too
", "time": "2022-07-25T14:42:36Z"}, {"author": "Jaimandeep Singh", "text": "no audio
", "time": "2022-07-25T14:42:46Z"}, {"author": "Lorenzo Miniero", "text": "Working on it
", "time": "2022-07-25T14:43:02Z"}, {"author": "Filip Skokan", "text": "its bck
", "time": "2022-07-25T14:43:03Z"}, {"author": "Joseph Heenan", "text": "better!
", "time": "2022-07-25T14:43:04Z"}, {"author": "Rolf Sonneveld", "text": "Audio ok again
", "time": "2022-07-25T14:43:05Z"}, {"author": "Jonas Primbs", "text": "works
", "time": "2022-07-25T14:43:08Z"}, {"author": "George Fletcher", "text": "Now audio is working again, thanks!
", "time": "2022-07-25T14:43:15Z"}, {"author": "Jaimandeep Singh", "text": "okay now
", "time": "2022-07-25T14:43:22Z"}, {"author": "Jonas Primbs", "text": "still working
", "time": "2022-07-25T14:43:23Z"}, {"author": "Filip Skokan", "text": ":thumbs up:
", "time": "2022-07-25T14:43:24Z"}, {"author": "Nat Sakimura", "text": "Good!
", "time": "2022-07-25T14:43:27Z"}, {"author": "Nat Sakimura", "text": "I share the sentiment with George.
", "time": "2022-07-25T14:50:27Z"}, {"author": "Nat Sakimura", "text": "(Re: PKCE v.s. state)
", "time": "2022-07-25T14:50:41Z"}, {"author": "Aaron Parecki", "text": "I think the issue is that PKCE was written in the context of mobile apps where the default is that each client is a separate instance, and that assumption isn't there in web server apps, so it needs to be explicitly spelled out
", "time": "2022-07-25T14:51:47Z"}, {"author": "George Fletcher", "text": "I agree. If we enhance PCKE in the context of web clients then we potentially can make this a replacement for state.
", "time": "2022-07-25T14:52:40Z"}, {"author": "Kristina Yasuda", "text": "JWP and SD-JWT do not exactly solve the same problems
", "time": "2022-07-25T14:52:55Z"}, {"author": "Kristina Yasuda", "text": "JWP is focusing on creating a JOSE based container that can be used with emerging advanced crypto. The range of problems tackled are unlinkability, predicates, holder binding and not just SD.
", "time": "2022-07-25T14:54:44Z"}, {"author": "Kristina Yasuda", "text": "While SD-JWT Focuses on extending existing implementation with proven crypto and focuses on SD
", "time": "2022-07-25T14:55:23Z"}, {"author": "Justin Richer", "text": "you MAY validate access tokens.
", "time": "2022-07-25T14:55:38Z"}, {"author": "Kristina Yasuda", "text": "The efforts are complimentary and not competing
", "time": "2022-07-25T14:55:42Z"}, {"author": "Nat Sakimura", "text": "Ouch Re:RFC6750 re token validation
", "time": "2022-07-25T14:55:44Z"}, {"author": "Hannes Tschofenig", "text": "Justin, you mentioned that there is some overlap but I failed to hear where the overlap is
", "time": "2022-07-25T14:55:47Z"}, {"author": "Hannes Tschofenig", "text": "(for the meeting minutes)
", "time": "2022-07-25T14:55:56Z"}, {"author": "Justin Richer", "text": "@hannes added
", "time": "2022-07-25T14:57:05Z"}, {"author": "Hannes Tschofenig", "text": "Thanks, Justin, for adding your comment on the microphone to the meeting minutes. Makes a lot of sense.
", "time": "2022-07-25T14:57:29Z"}, {"author": "Hannes Tschofenig", "text": "George, I failed to record your long question on the microphone. Could you add it to the meeting minutes?
", "time": "2022-07-25T14:58:06Z"}, {"author": "George Fletcher", "text": "Yes, though you got the main jist :)
", "time": "2022-07-25T15:00:35Z"}, {"author": "George Fletcher", "text": "@hannes done. Let me know if you'd like more detail
", "time": "2022-07-25T15:03:17Z"}, {"author": "Nat Sakimura", "text": "Multiple AA thing is actually in OIDC Core 1.0 as a use-case at least.
", "time": "2022-07-25T15:12:43Z"}, {"author": "George Fletcher", "text": "There is some support for this in the token exchange spec as well the \"act\" claim
", "time": "2022-07-25T15:13:21Z"}, {"author": "Hannes Tschofenig", "text": "Thanks, George
", "time": "2022-07-25T15:17:56Z"}, {"author": "George Fletcher", "text": "The Token Exchange spec also has aspects of this in the definition of the \"act\" claim. I suspect that authorization use cases may also need the embedding of other tokens. If the workgroup adopts this work, I recommend the workgroup look at authorization use cases as well as identity claim use cases.
", "time": "2022-07-25T15:18:27Z"}, {"author": "Nat Sakimura", "text": "+1
", "time": "2022-07-25T15:19:06Z"}, {"author": "George Fletcher", "text": "Doesn't OIDC define client_secret_jwt which could be used for a client_credentials token binding?
", "time": "2022-07-25T15:25:39Z"}, {"author": "George Fletcher", "text": "OIDC Core section 9
", "time": "2022-07-25T15:27:16Z"}, {"author": "Justin Richer", "text": "@george the token's not included in the assertion coverage there
", "time": "2022-07-25T15:27:47Z"}, {"author": "George Fletcher", "text": "no but it could be
", "time": "2022-07-25T15:29:19Z"}, {"author": "George Fletcher", "text": "actually... as long as the token issued from a client_credential grant contains the client_id you could use client_secret_jwt to protect the binding
", "time": "2022-07-25T15:30:08Z"}, {"author": "Joseph Heenan", "text": "you can use dpop with client credentials grant, the issue is really the use of client_secret_basic/post client authentication when private_key_jwt gives you almost the same semantics as DPoP would.
", "time": "2022-07-25T15:30:14Z"}, {"author": "Hirsch Singhal", "text": "^^ Yup, the mechanics are there, so the ask is mostly - [how] do you bind the token to the private_key_jwt? Should the same credential (long-lived registered key) be used to protect ephemeral tokens, or should there be a matching ephemeral key used?
\nHappy to spend time in a side session on this to plan concrete next steps
In regards to tokens crossing AS domains, I've implemented such a solution back in the days of AIM. It used Option-1
", "time": "2022-07-25T15:43:37Z"}, {"author": "Benjamin Kaduk", "text": "I'm a little curious if Atul has a specific definition of \"RPC\" in mind here
", "time": "2022-07-25T15:43:47Z"}, {"author": "Benjamin Kaduk", "text": "(since, e.g., I know a bunch of people for whom \"RPC\" means \"Sun RPC\", which seems to be not-this)
", "time": "2022-07-25T15:44:52Z"}, {"author": "George Fletcher", "text": "+1
", "time": "2022-07-25T15:45:03Z"}, {"author": "Justin Richer", "text": "I'm understanding it as \"an API with a bunch of related calls in a row and/or some kind of statefulness\" ... maybe?
", "time": "2022-07-25T15:45:46Z"}, {"author": "George Fletcher", "text": "I think there are many different aspects being brought up here... there are some references that might be helpful.
", "time": "2022-07-25T15:49:03Z"}, {"author": "George Fletcher", "text": "https://netflixtechblog.com/edge-authentication-and-token-agnostic-identity-propagation-514e47e0b602
", "time": "2022-07-25T15:49:09Z"}, {"author": "Benjamin Kaduk", "text": "I'm definitely hearing several intertwined topics as well.
", "time": "2022-07-25T15:49:18Z"}, {"author": "George Fletcher", "text": "", "time": "2022-07-25T15:49:19Z"}, {"author": "George Fletcher", "text": "That last one was my presentation but it has aspects that relate
", "time": "2022-07-25T15:49:44Z"}, {"author": "Aaron Parecki", "text": "It also sounds like these \"possible solutions\" on the slides are also things already in a handful of security recommendations across a few docs
", "time": "2022-07-25T15:51:23Z"}, {"author": "George Fletcher", "text": "+1
", "time": "2022-07-25T15:51:53Z"}, {"author": "Benjamin Kaduk", "text": "In the Kerberos world, Microsoft's \"services for user\" (SFU) extensions (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/3bff5864-8135-400e-bdd9-33b552051d94) include a concept of \"constrained delegation\" (\"s4u2proxy\"), where there's a privileged service that's allowed to act on behalf of certain (possibly all) users, but it has to specifically go and talk to the KDC each time it does so. The KDC can apply a very flexible policy when deciding whether to issue that ticket, including requiring some evidence that the user being impersonated is actually making some request of the proxy service.
", "time": "2022-07-25T15:59:17Z"}, {"author": "Nat Sakimura", "text": "Thanks
", "time": "2022-07-25T15:59:29Z"}]