Subject: [OAUTH-WG] Specifications for Identity Providers

From: Kevat Shah <[email-masked]>
Date: Sun, 8 Aug 2021 16:37:39 -0400

I propose that we expand upon specific functionality provided by Identity
Providers (IdPs) and tasks handled by them.

To start with, there should be clear specifications for various
functionalities that IdPs provide such as:

- Email verification on registration
- Specifications regarding "forgot password" functionality
- Specifications regarding "resest password" functionality for users that
are logged in

These specifications only pertain to Identity Providers, and allow an
industry-wide set of rules that each Identity Provider must follow. The
purpose of doing so would be to standardize various frequently used and
implemented flows that are secure and widely reusable.

Some problems that would be addressed by these specifications would be:

- How to securely implement functionality where a user is sent a link to
verify their email address

- How to securely implement functionality where a user is sent a
verification code to verify their email address

- How to securely implement functionality where a user is sent a link to
reset their password

- How to securely implement functionality where a user is sent a
verification code to reset their password

---

From: Tim Cappalli <[email-masked]>
Date: Mon, 9 Aug 2021 18:56:04 +0000

I believe this topic would be more W3C scope, not IETF.

tim
________________________________
From: OAuth <[email-masked]> on behalf of Kevat Shah <[email-masked]>
Sent: Sunday, August 8, 2021 16:37
To: [email-masked] <[email-masked]>
Subject: [OAUTH-WG] Specifications for Identity Providers

Some people who received this message don't often get email from [email-masked]. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification>
I propose that we expand upon specific functionality provided by Identity Providers (IdPs) and tasks handled by them.

To start with, there should be clear specifications for various functionalities that IdPs provide such as:

- Email verification on registration
- Specifications regarding "forgot password" functionality
- Specifications regarding "resest password" functionality for users that are logged in

These specifications only pertain to Identity Providers, and allow an industry-wide set of rules that each Identity Provider must follow. The purpose of doing so would be to standardize various frequently used and implemented flows that are secure and widely reusable.

- How to securely implement functionality where a user is sent a link to verify their email address

- How to securely implement functionality where a user is sent a verification code to verify their email address

- How to securely implement functionality where a user is sent a link to reset their password

- How to securely implement functionality where a user is sent a verification code to reset their password

---

From: Kevat Shah <[email-masked]>
Date: Mon, 9 Aug 2021 16:03:22 -0400

That's a good point. Is it fair to assume that W3C owns the standards for
most (if not all) standards related to Identity Providers? Or does it make
sense for IETF to start setting these standards in cases where W3C
standards don't exist?

- Kevat

On Mon, Aug 9, 2021, 2:56 PM Tim Cappalli <[email-masked]>
wrote:

> ------------------------------
> *From:* OAuth <[email-masked]> on behalf of Kevat Shah <
> [email-masked]>
> *Sent:* Sunday, August 8, 2021 16:37
> *To:* [email-masked] <[email-masked]>
> *Subject:* [OAUTH-WG] Specifications for Identity Providers
>
> Some people who received this message don't often get email from
> [email-masked]. Learn why this is important
> <http://aka.ms/LearnAboutSenderIdentification>

---

From: Tim Cappalli <[email-masked]>
Date: Mon, 9 Aug 2021 20:06:09 +0000

I don't think there is explicit ownership, but generally password and magic link type "stuff" happens in W3C.

There are existing work efforts around standardizing password reset endpoint discovery, password complexity schemas, etc.
________________________________
From: Kevat Shah <[email-masked]>
Sent: Monday, August 9, 2021 16:03
To: Tim Cappalli <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: Re: [OAUTH-WG] Specifications for Identity Providers

You don't often get email from [email-masked]. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification>
That's a good point. Is it fair to assume that W3C owns the standards for most (if not all) standards related to Identity Providers? Or does it make sense for IETF to start setting these standards in cases where W3C standards don't exist?

- Kevat

On Mon, Aug 9, 2021, 2:56 PM Tim Cappalli <[email-masked]<mailto:[email-masked]>> wrote:
I believe this topic would be more W3C scope, not IETF.

tim
________________________________
From: OAuth <[email-masked]<mailto:[email-masked]>> on behalf of Kevat Shah <[email-masked]<mailto:[email-masked]>>
Sent: Sunday, August 8, 2021 16:37
To: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Subject: [OAUTH-WG] Specifications for Identity Providers

Some people who received this message don't often get email from [email-masked]<mailto:[email-masked]>. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification>
I propose that we expand upon specific functionality provided by Identity Providers (IdPs) and tasks handled by them.

---

From: <[email-masked]>
Date: Mon, 9 Aug 2021 16:11:24 -0400

Although the IETF has been involved in Best Commercial Practices (BCP) (see
https://www.ietf.org/rfc/bcp-index.txt )  which I think was the subject of
Kevat's original email. 

So perhaps this is a subject matter that could co-exist in both the IETF and
W3C?

From: OAuth <[email-masked]> On Behalf Of Tim Cappalli
Sent: Monday, August 9, 2021 4:06 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Specifications for Identity Providers

I don't think there is explicit ownership, but generally password and magic
link type "stuff" happens in W3C.

There are existing work efforts around standardizing password reset endpoint
discovery, password complexity schemas, etc.

  _____  

From: Kevat Shah <[email-masked] <mailto:[email-masked]> >
Sent: Monday, August 9, 2021 16:03
To: Tim Cappalli <[email-masked]
<mailto:[email-masked]> >
Cc: [email-masked] <mailto:[email-masked]>  <[email-masked]
<mailto:[email-masked]> >
Subject: Re: [OAUTH-WG] Specifications for Identity Providers 

You don't often get email from [email-masked]
<mailto:[email-masked]> . Learn why this is important
<http://aka.ms/LearnAboutSenderIdentification> 

That's a good point. Is it fair to assume that W3C owns the standards for
most (if not all) standards related to Identity Providers? Or does it make
sense for IETF to start setting these standards in cases where W3C standards
don't exist?

- Kevat

On Mon, Aug 9, 2021, 2:56 PM Tim Cappalli <[email-masked]
<mailto:[email-masked]> > wrote:

tim

  _____  

From: OAuth <[email-masked] <mailto:[email-masked]> > on
behalf of Kevat Shah <[email-masked] <mailto:[email-masked]> >
Sent: Sunday, August 8, 2021 16:37
To: [email-masked] <mailto:[email-masked]>  <[email-masked]
<mailto:[email-masked]> >
Subject: [OAUTH-WG] Specifications for Identity Providers 

Some people who received this message don't often get email from
[email-masked] <mailto:[email-masked]> . Learn why this is
important <http://aka.ms/LearnAboutSenderIdentification>

---

From: Kevat Shah <[email-masked]>
Date: Mon, 9 Aug 2021 16:14:38 -0400

How would that work? Would we need to work with W3C to ensure conformity of
standards?

On Mon, Aug 9, 2021, 4:11 PM <[email-masked]> wrote:

> Although the IETF has been involved in Best Commercial Practices (BCP)
> (see https://www.ietf.org/rfc/bcp-index.txt )  which I think was the
> subject of Kevat’s original email.
>
>
>
> So perhaps this is a subject matter that could co-exist in both the IETF
> and W3C?
>
>
>
>
>
>
>
> *From:* OAuth <[email-masked]> *On Behalf Of *Tim Cappalli
> *Sent:* Monday, August 9, 2021 4:06 PM
> *To:* [email-masked]
> *Cc:* [email-masked]
> *Subject:* Re: [OAUTH-WG] Specifications for Identity Providers
>
>
>
> There are existing work efforts around standardizing password reset
> endpoint discovery, password complexity schemas, etc.
> *From:* Kevat Shah <[email-masked]>
> *Sent:* Monday, August 9, 2021 16:03
> *To:* Tim Cappalli <[email-masked]>
> *Cc:* [email-masked] <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Specifications for Identity Providers
>
>
>
> You don't often get email from [email-masked]. Learn why this is

---

From: Tim Cappalli <[email-masked]>
Date: Mon, 9 Aug 2021 20:17:29 +0000

I think the first step would be finding the appropriate IETF group. I don't think this is in scope for OAuth-WG as this topic seems to be about account management and user credentials.
________________________________
From: Kevat Shah <[email-masked]>
Sent: Monday, August 9, 2021 16:14
To: [email-masked] <[email-masked]>
Cc: Tim Cappalli <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: [OAUTH-WG] Specifications for Identity Providers

How would that work? Would we need to work with W3C to ensure conformity of standards?

On Mon, Aug 9, 2021, 4:11 PM <[email-masked]<mailto:[email-masked]>> wrote:

Although the IETF has been involved in Best Commercial Practices (BCP) (see https://www.ietf.org/rfc/bcp-index.txt<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfc%2Fbcp-index.txt&data=04%7C01%7CTim.Cappalli%40microsoft.com%7C41ce5aec4d7a4cf7efef08d95b726f93%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637641369333693489%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=cDC15G1s1n4JCY%2Fk5vFDDyCj6WF%2Bhd8Pd4Fq0JNEIzQ%3D&reserved=0> )  which I think was the subject of Kevat’s original email.

So perhaps this is a subject matter that could co-exist in both the IETF and W3C?

From: OAuth <[email-masked]<mailto:[email-masked]>> On Behalf Of Tim Cappalli
Sent: Monday, August 9, 2021 4:06 PM
To: [email-masked]<mailto:[email-masked]>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [OAUTH-WG] Specifications for Identity Providers

From: Kevat Shah <[email-masked]<mailto:[email-masked]>>
Sent: Monday, August 9, 2021 16:03
To: Tim Cappalli <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Specifications for Identity Providers

You don't often get email from [email-masked]<mailto:[email-masked]>. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification>

- Kevat

tim

---

From: Warren Parad <[email-masked]>
Date: Mon, 9 Aug 2021 22:17:48 +0200

I think it would be prudent to potentially ask *why?* What problem is
necessary to be solved by discussing/standardizing these particular
features? There could be, but without understanding, knowing how best to
tackle it is a challenging conversation without the right context.

Warren Parad

Founder, CTO
Secure your user data with IAM authorization as a service. Implement
Authress <https://authress.io/>.

On Mon, Aug 9, 2021 at 10:15 PM Kevat Shah <[email-masked]> wrote:

>> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Kevat Shah <[email-masked]>
Date: Mon, 9 Aug 2021 16:43:53 -0400

@[email-masked] - Using forgot password and registration verification
links or codes could be used as vectors of attack.

One possible point of insecurity that I have seen is this: after a user
verifies their code or link, they are often sent to another page where they
enter more information (such as additional user information or new
passwords). The user isn't supposed to be authenticated at this step, and
yet the application must know who the user is.

How do we confirm the user's identity without authenticating them for these
steps?

This is the driving factor (the "why") for this ask.

@[email-masked] - I agree. Which channels should we use to
discuss this issue?

- Kevat

On Mon, Aug 9, 2021, 4:17 PM Warren Parad <[email-masked]> wrote:

>>> That's a good point. Is it fair to assume that W3C owns the standards
>>> for most (if not all) standards related to Identity Providers? Or does it
>>> make sense for IETF to start setting these standards in cases where W3C
>>> standards don't exist?
>>>
>>>
>>>
>>> - Kevat
>>>
>>> I propose that we expand upon specific functionality provided by
>>> Identity Providers (IdPs) and tasks handled by them.
>>>
>>>
>>>

---

From: Warren Parad <[email-masked]>
Date: Mon, 9 Aug 2021 22:55:26 +0200

I definitely see that there is room for a potential attack depending on the
internal implementation. Wouldn't that be only relevant internally to the
auth server though? Would adding a feature flag to the discovery document
or visibility into configuration help reduce the attack surface? Perhaps, I
would need to see the explicit vulnerability and how it would be
potentially mitigated. From my uninformed perspective it seems like trying
to protect users against a phishing attack that uses a malicious auth
server to emulate an honest one, though I could be missing something
critical.

Any additional information would be appreciated.

- Warren

Warren Parad

Founder, CTO

On Mon, Aug 9, 2021 at 10:44 PM Kevat Shah <[email-masked]> wrote:

> How do we confirm the user's identity without authenticating them for
> these steps?
>

---

From: Domingos Creado <[email-masked]>
Date: Mon, 9 Aug 2021 18:13:58 -0300

Hi All,

I think those are valid points, but they can be better addressed on
identity management forums like idsa or idpro.

https://www.idsalliance.org/

https://idpro.org/

On Mon, Aug 9, 2021 at 5:55 PM Warren Parad <wparad=
[email-masked]> wrote:

> I definitely see that there is room for a potential attack depending on
> the internal implementation. Wouldn't that be only relevant internally to
> the auth server though? Would adding a feature flag to the discovery
> document or visibility into configuration help reduce the attack surface?
> Perhaps, I would need to see the explicit vulnerability and how it would be

---

From: Kevat Shah <[email-masked]>
Date: Tue, 10 Aug 2021 14:53:06 -0400

Agreed! Thank you all for the feedback!

On Mon, Aug 9, 2021, 5:14 PM Domingos Creado <[email-masked]>
wrote:

>>>>>> Although the IETF has been involved in Best Commercial Practices
>>>>>> (BCP) (see https://www.ietf.org/rfc/bcp-index.txt )  which I think
>>>>>> was the subject of Kevat’s original email.
>>>>>>
>>>>>>
>>>>>>
>>>>>> You don't often get email from [email-masked]. Learn why this
>>>>>> is important <http://aka.ms/LearnAboutSenderIdentification>
>>>>>>
>>>>>> link to reset their password
>>>>>>
>>>>>>
>>>>>>