Subject: [kitten] SPN audience claim for GSS BrowserID

From: Luke Howard <[email-masked]>
Date: Mon, 7 Oct 2013 12:26:52 +1100

Apologies for the cross-post.

A brief reminder: GSS BrowserID [1] profiles Mozilla Persona for application protocols that use SASL or GSS-API, such as IMAP and SMTP.

The audience in the generated assertion is the “service principal name”, or SPN, which identifies the target service. This is of the form service[/hostname[/instance]], for example “imap/mail.example.com”. Currently we are encoding these as URIs with the prefix urn:ietf:params:gss:spn: (so, in previous example, the “aud” claim would have the value “urn:ietf:params:gss:spn:imap/mail.example.com”).

Rereading draft-ietf-oauth-json-web-token, I note that the audience claim is a StringOrURI, and there's nothing in the BrowserID code that requires the audience to be a URI, at least for internal API consumers.

Any thoughts thus on dropping the URN prefix and placing the unadorned SPN in the audience claim?

-- Luke

[1] http://tools.ietf.org/html/draft-howard-gss-browserid-05