Subject: [jose] Is an OpenID Connect request really a JWT?

From: "Manger, James H" <[email-masked]>
Date: Fri, 18 May 2012 14:49:18 +1000

OpenID Connect [http://openid.net/specs/openid-connect-standard-1_0.html#req_param_method] says:
  "The request parameter is a JWT encoded OpenID Request Object...
   The JWT object MAY be signed or signed and encrypted via JWS and JWE"

It gives the example below, which is a JWS with "typ":"JWT". The payload is a JSON object with 8 fields (response_type, client_id, redirect_uri, scope, state, nonce, userinfo (with lots of sub-fields), id_token (with sub-fields)). The payload has none of the 8 reserved claims from the JWT spec (exp, nbf, iat, iss, aud, prn, jti, typ).

Can we really call that a JWT?
It seems implausible that the  8 fields in this example (response_type...) are supposed to be treated as "Private Claim Names" as per the JWT spec.

We have two totally separate ideas both being called "JWT".

1.       JSON object carrying a bunch of claims.

2.       A base64-based way to package any blob of bytes in unprotected, signed, or encrypted forms.

Suggestion: use "JWT" for #2; pick a new name for #1 (perhaps JSON Claim Set); lots of changes to spec text.

JWT algorithm = HS256

HMAC HASH Key = 'aaa'

JSON Encoded Header = "{"alg":"HS256","typ":"JWT"}"

JSON Encoded Payload = "{"response_type":"code id_token",

    "client_id":"s6BhdRkqt3",

    "redirect_uri":"https://client.example.com/cb",

    "scope":"openid profile",

    "state":"af0ifjsldkj",

    "nonce":"n-0S6_WzA2Mj",

    "userinfo":{"claims":{"name":null,"nickname":{"optional":true},

        "email":null,"verified":null,

        "picture":{"optional":true}}},

    "id_token":{"max_age":86400,"claims":{"acr":{"values":["2"]}}}

JWT = eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXNwb25zZV90eXBlIjoiY29kZ

    SBpZF90b2tlbiIsImNsaWVudF9pZCI6InM2QmhkUmtxdDMiLCJyZWRpcmVjdF91cmkiO

    iJodHRwczpcL1wvY2xpZW50LmV4YW1wbGUuY29tXC9jYiIsInNjb3BlIjoib3BlbmlkI

    HByb2ZpbGUiLCJzdGF0ZSI6ImFmMGlmanNsZGtqIiwibm9uY2UiOiJuLTBTNl9XekEyT

    WoiLCJ1c2VyaW5mbyI6eyJjbGFpbXMiOnsibmFtZSI6bnVsbCwibmlja25hbWUiOnsib

    3B0aW9uYWwiOnRydWV9LCJlbWFpbCI6bnVsbCwidmVyaWZpZWQiOm51bGwsInBpY3R1c

    mUiOnsib3B0aW9uYWwiOnRydWV9fX0sImlkX3Rva2VuIjp7Im1heF9hZ2UiOjg2NDAwL

    CJjbGFpbXMiOnsiYWNyIjp7InZhbHVlcyI6WyIyIl19fX19.ou2Yc1B9a5iZLqbzBxE9

    5aNS0pSfRClCqM77n85ehGo

--
James Manger

---

From: Mike Jones <[email-masked]>
Date: Fri, 18 May 2012 16:06:53 +0000

Actually, I'd received similar feedback from other parties.  It probably makes sense to change the description of the OpenID Request Object from being a JWT to being a JWS signed JSON object.

BTW, if you would like to contribute to the OpenID Connect specs, the better venue would be to join the working group and send your feedback to the OpenID Specs AB mailing list http://lists.openid.net/mailman/listinfo/openid-specs-ab.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Manger, James H
Sent: Thursday, May 17, 2012 9:49 PM
To: [email-masked]
Subject: [jose] Is an OpenID Connect request really a JWT?

JWT algorithm = HS256

HMAC HASH Key = 'aaa'

    "state":"af0ifjsldkj",

    "nonce":"n-0S6_WzA2Mj",

    5aNS0pSfRClCqM77n85ehGo

--
James Manger

---

From: "Manger, James H" <[email-masked]>
Date: Sun, 20 May 2012 18:06:43 +1000

Mike,

> Actually, I'd received similar feedback from other parties.  It probably makes sense to change the description of the OpenID Request Object from being a JWT to being a JWS signed JSON object.

I don't think so. The OpenID-Connect spec says the request "MAY be signed or signed and encrypted". It looks like the request can be a JWS, a JWE, or unprotected. Saying it is a JWS doesn't cover the options.

We do need a label for "a base64-based way to package a blob of bytes in unprotected, signed, or encrypted forms".
How about keeping "JWT" for this (and not for a JSON object carrying a bunch of claims)?
In either case "typ":"JWT" is wrong in this instance.

> BTW, if you would like to contribute to the OpenID Connect specs, the better venue would be to join the working group and send your feedback to the OpenID Specs AB mailing list http://lists.openid.…

At the moment I was focusing on the JOSE's JWx specs. OpenID Connect was just a good illustration of confusion around "JWT".

[P.S. Should the "signed and encrypted" option quoted above from OpenID Connect actually be "signed then encrypted"?]

--
James Manger

JWT algorithm = HS256

HMAC HASH Key = 'aaa'

    "state":"af0ifjsldkj",

    "nonce":"n-0S6_WzA2Mj",

    5aNS0pSfRClCqM77n85ehGo

--
James Manger