Subject: [OAUTH-WG] Call for adoption: OAuth Security Topics

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 2 Feb 2017 08:09:57 +0100

Hi all,

this is the call for adoption of the 'OAuth Security Topics' document
following the positive call for adoption at the last IETF
meeting in Seoul.

Here is the document:
https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00

The intention with this document is to have a place to collect
discussions and conclusions around OAuth 2.0 security and to reference
the actual solution specifications.

Please let us know by Feb 16th whether you accept / object to the
adoption of this document as a starting point for work in the OAuth
working group.

Ciao
Hannes & Derek

---

From: Anthony Nadalin <[email-masked]>
Date: Thu, 2 Feb 2017 19:11:09 +0000

I would be in favor of this 

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Wednesday, February 1, 2017 11:10 PM
To: [email-masked]
Subject: [OAUTH-WG] Call for adoption: OAuth Security Topics

Hi all,

this is the call for adoption of the 'OAuth Security Topics' document following the positive call for adoption at the last IETF meeting in Seoul.

Here is the document:
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-lodderstedt-oauth-security-topics-00&data=02%7C01%7Ctonynad%40microsoft.com%7Cdd2d04df662a4bfe36e508d44b3a84e6%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636216162098338101&sdata=9tMjjKtTBQrNVEEpwfMaIH2gTymyADdgjEJnKU4MP6U%3D&reserved=0

The intention with this document is to have a place to collect discussions and conclusions around OAuth 2.0 security and to reference the actual solution specifications.

Please let us know by Feb 16th whether you accept / object to the adoption of this document as a starting point for work in the OAuth working group.

Ciao
Hannes & Derek

---

From: Phil Hunt <[email-masked]>
Date: Thu, 2 Feb 2017 11:18:22 -0800

+1

Phil

Oracle Corporation, Identity Cloud Services & Identity Standards
@independentid
www.independentid.com <http://www.independentid.com/>[email-masked] <mailto:[email-masked]>

> On Feb 2, 2017, at 11:11 AM, Anthony Nadalin <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Thu, 2 Feb 2017 19:19:41 +0000

I support adoption.

				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Wednesday, February 1, 2017 11:10 PM
To: [email-masked]
Subject: [OAUTH-WG] Call for adoption: OAuth Security Topics

Hi all,

Here is the document:

Ciao
Hannes & Derek

---

From: Justin Richer <[email-masked]>
Date: Thu, 2 Feb 2017 14:49:42 -0500

+1, it's a good topic and this document is a good starting point.

  -- Justin

---

From: George Fletcher <[email-masked]>
Date: Thu, 2 Feb 2017 16:31:00 -0500

+1 for me too :)

---

From: John Bradley <[email-masked]>
Date: Thu, 2 Feb 2017 18:33:38 -0300

I am in favour of adoption.
> On Feb 2, 2017, at 4:09 AM, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
>

---

From: Brian Campbell <[email-masked]>
Date: Thu, 2 Feb 2017 14:55:08 -0700

+ 1

On Thu, Feb 2, 2017 at 12:49 PM, Justin Richer <[email-masked]> wrote:

> Here is the document:https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00
>
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>
>

---

From: Jim Willeke <[email-masked]>
Date: Thu, 2 Feb 2017 17:30:09 -0500

+!
I agree this is needed.

--
-jim
Jim Willeke

---

From: William Denniss <[email-masked]>
Date: Fri, 3 Feb 2017 15:57:17 -0800

I support the adoption of this document as a working group item.

---

From: Jim Manico <[email-masked]>
Date: Fri, 3 Feb 2017 14:08:01 -1000

I'm just some random idiot am an not in this working group but the work
from
https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00
<https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00>
is one of the most up to date and useful OAuth security resources every
published. I am thrilled to see more work put into it.

Aloha, Jim

On 2/3/17 1:57 PM, William Denniss wrote:
> On Thu, Feb 2, 2017 at 2:30 PM, Jim Willeke <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     +! 
>     I agree this is needed.
>
>     --
>     -jim
>     Jim Willeke
>
>     On Thu, Feb 2, 2017 at 4:33 PM, John Bradley <[email-masked]
>     <mailto:[email-masked]>> wrote:
>
>         > On Feb 2, 2017, at 4:09 AM, Hannes Tschofenig
>         <[email-masked] <mailto:[email-masked]>>
>         wrote:
>         >
>         > Hi all,
>         >
>         <https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00>
>         >
>         > [email-masked] <mailto:[email-masked]>
>         <https://www.ietf.org/mailman/listinfo/oauth>
>
>
>         [email-masked] <mailto:[email-masked]>
>         <https://www.ietf.org/mailman/listinfo/oauth>
>
>
>
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/oauth>
>
>
>
>

-- 
Jim Manico
Manicode Security
https://www.manicode.com

---

From: Nat Sakimura <[email-masked]>
Date: Mon, 06 Feb 2017 12:02:08 +0000

A belated +1

On Sat, Feb 4, 2017, 9:08 AM Jim Manico <[email-masked]> wrote:

> https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00 is
> one of the most up to date and useful OAuth security resources every
> Manicode Securityhttps://www.manicode.com
>
-- 

Nat Sakimura

Chairman of the Board, OpenID Foundation

---

From: Denis <[email-masked]>
Date: Mon, 6 Feb 2017 13:30:22 +0100

The scope of this draft is unclear. The title states: "OAuth Security 
Topics".**

I have some questions:

  * Does this document intend to cover only the OAuth 2.0 delegation
    protocol (since Justin said that OAuth 2.0 is a delegation protocol)
    or OpenId Connect as well which is not limited to a delegation
    protocol ?
  * Should we discuss OpenID Connect issues and/or solutions in an IETF
    RFC ?

If this document is going to be progressed, the threats should be 
clearly separated whether they relate to a delegation model or to
a client-server access control model. This is not currently the case.

If this document is going to be progressed, the ABC attack (in the 
context of an access control model) should be mentioned even if there exits
no way to counter it given the current implicit assumptions made in 
OAuth 2.0, in particular the use of software only implementations.

Denis

> A belated +1
>
>
> On Sat, Feb 4, 2017, 9:08 AM Jim Manico <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     I'm just some random idiot am an not in this working group but the
>     work from
>     is one of the most up to date and useful OAuth security resources
>     every published. I am thrilled to see more work put into it.
>
>     Aloha, Jim
>
>
>>         On Thu, Feb 2, 2017 at 4:33 PM, John Bradley
>>         <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>             <[email-masked]
>>             <mailto:[email-masked]>> wrote:
>>             >
>>             > Hi all,
>>             >

---

From: Justin Richer <[email-masked]>
Date: Mon, 6 Feb 2017 10:27:31 -0500

OpenID Connect is the intellectual property of the OpenID Foundation and it is discussed there.

 — Justin

> On Feb 6, 2017, at 7:30 AM, Denis <[email-masked]> wrote:
> 
> 
> The scope of this draft is unclear. The title states: "OAuth Security Topics".
> I have some questions:
> Does this document intend to cover only the OAuth 2.0 delegation protocol (since Justin said that OAuth 2.0 is a delegation protocol) 
> or OpenId Connect as well which is not limited to a delegation protocol ?
> Should we discuss OpenID Connect issues and/or solutions in an IETF RFC ?
> If this document is going to be progressed, the threats should be clearly separated whether they relate to a delegation model or to 
> If this document is going to be progressed, the ABC attack (in the context of an access control model) should be mentioned even if there exits 
> no way to counter it given the current implicit assumptions made in OAuth 2.0, in particular the use of software only implementations.
> 
> Denis
> 
>> A belated +1
>> 
>> 
>> On Sat, Feb 4, 2017, 9:08 AM Jim Manico <[email-masked] <mailto:[email-masked]>> wrote:
>> I'm just some random idiot am an not in this working group but the work from https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00 <https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00> is one of the most up to date and useful OAuth security resources every published. I am thrilled to see more work put into it.
>> 
>> Aloha, Jim
>> 
>> 
>>> On Thu, Feb 2, 2017 at 2:30 PM, Jim Willeke <[email-masked] <mailto:[email-masked]>> wrote:
>>> +! 
>>> I agree this is needed.
>>> 
>>> --
>>> -jim
>>> Jim Willeke
>>> 
>>> On Thu, Feb 2, 2017 at 4:33 PM, John Bradley <[email-masked] <mailto:[email-masked]>> wrote:
>>> > On Feb 2, 2017, at 4:09 AM, Hannes Tschofenig <[email-masked] <mailto:[email-masked]>> wrote:
>>> >
>>> > Hi all,
>>> >
>>> > https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00 <https://tools.ietf.org/html/draft-lodderstedt-oauth-security-topics-00>
>>> >
>>> > https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>>> 
>>> 
>>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>>> 
>>> 
>>> 
>>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>>> 
>>> 
>>> 
>>> 
>>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>> 
>> -- 
>> Jim Manico
>> Manicode Security
>> https://www.manicode.com <https://www.manicode.com/>_______________________________________________
>> OAuth mailing list
>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
>> -- 
>> Nat Sakimura
>> 
>> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 20 Feb 2017 11:52:44 +0100

Hi Denis,

thanks for your feedback regarding the scope.

The scope for this document is limited to the specifications we develop
in the IETF OAuth working group. OpenID Connect, UMA, or other
specifications need to be dealt with in other SDOs.

The document only represents a starting point for work and hence various
attacks, such as the ABC attack you mentioned, can be incorporated in
future versions of the document.

Ciao
Hannes