> Frederik, > > You understood me correctly and you are right. The construction as I > wrote it does not work, and it fails on exactly the case DTR exists > for. > > I wrote that the AS should decline to issue without a fresh artifact > from the user's authenticator. "Fresh" was the error. If the artifact > has to be produced at or near decision time, then every legitimate > deferred request fails whenever the user has walked away - which is > the normal case, not the edge case. That is a liveness failure dressed > as a security property, and no amount of arranging around it recovers > the goal you have. > > I conflated two things that need separating, and only one of them > survives your objection. > > Per-delegation scoping survives. An artifact signed at request time, > bound to that specific action's parameters, verified at decision time > with no user present, addresses what Mitchell raised: the unit of > authority for a client serving many principals is the individual > delegation rather than the client. A steered agent cannot obtain one > for the action it was steered into, and the other tasks it is running > correctly are unaffected. Nothing here needs the user at decision > time, and nothing here needs a channel to the AS. > > Withdrawal does not survive. If the artifact is signed up front and > remains valid through the deferral, the user cannot revoke by > withholding anything, because there is nothing left for them to > withhold. Silence-as-cancellation only works if presence is expected, > and you have just shown that it is not. So your original position > stands: cancellation by an initiating entity that is not the client > needs a way to reach the AS, and that belongs in a profile rather than > in DTR. > > The one thing between the two that I think is real, offered without > claiming it solves the above: an artifact can carry a validity window > the user chooses while they are present. It bounds exposure without > requiring them later - if the AS decides inside the window it issues, > outside it it does not. That is not withdrawal and I would not present > it as such. It is the user pre-committing to how long they are willing > to remain committed, which is a weaker thing but is available without > any channel. > > I am not proposing a change to the draft on any of this. > > Mohamad Khalil-Yossif
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
