Subject: [OAUTH-WG] DPoP and implicit/hybrid flows

From: Dmitry Telegin <[email-masked]>
Date: Fri, 16 Jul 2021 01:47:02 +0300

Hi,

The DPoP spec currently defines how to obtain a DPoP-bound token via token
endpoint invocations (namely, authorization_code and refresh_token grants).
But it is also possible to obtain access token prior to code-to-token
exchange, via OAuth implicit/hybrid flows.

Do we have any plans to support DPoP in authorization endpoint (in addition
to token endpoint) and implicit/hybrid flows? Is yes, what it might look
like? a "dpop" request parameter or a "DPoP" header?

Regards,
Dmitry

---

From: Justin Richer <[email-masked]>
Date: Fri, 16 Jul 2021 12:28:50 -0400

I personally hope we don’t. JAR already gives us signed requests at the authorization endpoint, though the last piece would be binding the token. 

 — Justin

> On Jul 15, 2021, at 6:47 PM, Dmitry Telegin <dmitryt=[email-masked]> wrote:
> 
> Hi,
> 
> The DPoP spec currently defines how to obtain a DPoP-bound token via token endpoint invocations (namely, authorization_code and refresh_token grants). But it is also possible to obtain access token prior to code-to-token exchange, via OAuth implicit/hybrid flows.
> 
> Do we have any plans to support DPoP in authorization endpoint (in addition to token endpoint) and implicit/hybrid flows? Is yes, what it might look like? a "dpop" request parameter or a "DPoP" header?
> 
> Regards,
> Dmitry
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Bradley <[email-masked]>
Date: Fri, 16 Jul 2021 13:18:01 -0400

Binding the token would be required for OAuth or Connect to meet the
SP800-63 FAL3 requirements.

Something like DPoP might work.  I don't think DPoP itself should directly
add support.

I don't know if people really care about FAL3,  unfourtunatly the simple
solution of using token-binding seems quite dead in browsers.

John B.

On Fri, Jul 16, 2021, 12:29 PM Justin Richer <[email-masked]> wrote:

> I personally hope we don’t. JAR already gives us signed requests at the
> authorization endpoint, though the last piece would be binding the token.
>
>  — Justin
>
> > The DPoP spec currently defines how to obtain a DPoP-bound token via
> token endpoint invocations (namely, authorization_code and refresh_token
> grants). But it is also possible to obtain access token prior to
> code-to-token exchange, via OAuth implicit/hybrid flows.
> >
> > Do we have any plans to support DPoP in authorization endpoint (in
> addition to token endpoint) and implicit/hybrid flows? Is yes, what it
> might look like? a "dpop" request parameter or a "DPoP" header?
> >
> > Regards,
> > Dmitry

---

From: Brian Campbell <[email-masked]>
Date: Fri, 16 Jul 2021 11:32:21 -0600

Binding tokens issued directly from the authorization endpoint has been
intentionally considered out of scope for the main DPoP draft.

This draft
https://datatracker.ietf.org/doc/html/draft-jones-oauth-dpop-implicit-00
was written that explores what it might look like. But it hasn't seen a lot
of interest or momentum.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Justin Richer <[email-masked]>
Date: Fri, 16 Jul 2021 14:18:26 -0400

Binding the access token is not required for FAL3. FAL has nothing to say about access tokens:

https://pages.nist.gov/800-63-FAQ/#q-c8 <https://pages.nist.gov/800-63-FAQ/#q-c8>

FAL3 is about presenting proof of a key representing the user alongside an assertion representing the user. In OIDC this would mean something like the ID token having a key identifier inside of it and the RP prompting the user for the key. This has nothing to do with access tokens, or even calling an identity API like a UserInfo Endpoint. DPoP doesn’t help with any of that since DPoP is about access tokens.

 — Justin

> On Jul 16, 2021, at 1:18 PM, John Bradley <[email-masked]> wrote:
> 
> Binding the token would be required for OAuth or Connect to meet the SP800-63 FAL3 requirements. 
> 
> Something like DPoP might work.  I don't think DPoP itself should directly add support. 
> 
> I don't know if people really care about FAL3,  unfourtunatly the simple solution of using token-binding seems quite dead in browsers. 
> 
> John B. 
> 
> 
> 
> 
> 
> On Fri, Jul 16, 2021, 12:29 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
> > On Jul 15, 2021, at 6:47 PM, Dmitry Telegin <dmitryt=[email-masked] <mailto:[email-masked]>> wrote:
> > 
> > Hi,
> > 
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>

---

From: John Bradley <[email-masked]>
Date: Fri, 16 Jul 2021 14:38:50 -0400

Yes FAL3 would be about binding the idToken not the access token so
different from what Mike proposed for implicit.

On Fri, Jul 16, 2021, 2:18 PM Justin Richer <[email-masked]> wrote:

> https://pages.nist.gov/800-63-FAQ/#q-c8
>
> FAL3 is about presenting proof of a key representing the user alongside an
> assertion representing the user. In OIDC this would mean something like the
> ID token having a key identifier inside of it and the RP prompting the user
> for the key. This has nothing to do with access tokens, or even calling an
> identity API like a UserInfo Endpoint. DPoP doesn’t help with any of that
> since DPoP is about access tokens.
>
>  — Justin
>