On Sat, Aug 15, 2020 at 3:08 AM Vladimir Dzhuvinov
wrote:
> Regarding the "sub != client_id" check -- could a simple rejection of all
> JWTs with "sub" present suffice?
>
Prohibiting the use of "sub" in request object JWTs would suffice, yes. I'd
suggested the more narrow/specific prohibition
additional
>> IESG comments.
>>
>> -- Mike
>>
>> -----Original Message-
>> From: OAuth On Behalf Of Benjamin Kaduk
>> Sent: Thursday, August 13, 2020 2:59 PM
>> To: Brian Campbell
>> Cc: draft-ietf-oauth-jws
gt; Cc: draft-ietf-oauth-jws...@ietf.org
> <mailto:draft-ietf-oauth-jws...@ietf.org>; oauth-cha...@ietf.org
> <mailto:oauth-cha...@ietf.org>; The IESG <mailto:i...@ietf.org>>; oauth <mailto:oauth@ietf.org>>
> Subject: Re: [OAUTH-WG] Be
tf.org; The IESG <
> i...@ietf.org>; oauth
> Subject: Re: [OAUTH-WG] Benjamin Kaduk's No Objection on
> draft-ietf-oauth-jwsreq-26: (with COMMENT)
>
> Oops, that's my bad. Thanks for the correction -- I've linked to your
> message in the datatracker (but didn't bother to have t
No Objection on
draft-ietf-oauth-jwsreq-26: (with COMMENT)
Oops, that's my bad. Thanks for the correction -- I've linked to your message
in the datatracker (but didn't bother to have the datatracker send a third copy
of my updated-again ballot position).
-Ben
On Thu, Aug 13, 2020 at 03:00:33PM
Oops, that's my bad. Thanks for the correction -- I've linked to your
message in the datatracker (but didn't bother to have the datatracker send
a third copy of my updated-again ballot position).
-Ben
On Thu, Aug 13, 2020 at 03:00:33PM -0600, Brian Campbell wrote:
> While some discussion of why
While some discussion of why explicit typing was not used might be useful
to have, that thread started with a request for security considerations
prohibiting use of the "sub" with a client ID value. Because such a request
JWT could be repurposed for JWT client authentication. And explicit typing
Hi Nat,
Also inline.
On Thu, Aug 13, 2020 at 11:25:27PM +0900, Nat Sakimura wrote:
>Thanks Benjamin.
>My replies inline below:
>On Wed, Aug 12, 2020 at 12:53 AM Benjamin Kaduk via Datatracker
> wrote:
>
> Benjamin Kaduk has entered the following ballot position for
>
Thanks Benjamin.
My replies inline below:
On Wed, Aug 12, 2020 at 12:53 AM Benjamin Kaduk via Datatracker <
nore...@ietf.org> wrote:
> Benjamin Kaduk has entered the following ballot position for
> draft-ietf-oauth-jwsreq-26: No Objection
>
> When responding, please keep the subject line intact
Benjamin Kaduk has entered the following ballot position for
draft-ietf-oauth-jwsreq-26: No Objection
When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)
Please refer to
Benjamin Kaduk has entered the following ballot position for
draft-ietf-oauth-jwsreq-26: No Objection
When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)
Please refer to
11 matches
Mail list logo
