Subject: Re: [Unbearable] Referred token binding IDs

From: =JeffH <[email-masked]>
Date: Tue, 29 Mar 2016 08:46:58 -0700

On Friday, March 25, 2016 at 8:33 PM, Nick wrote:
 >
 > If you want TP4 to generate a token bound to TBID1,

given the flexibility in typical federation (Fed) frameworks, such as SAML
and OIDC and WS-Federation, I am thinking we may need similar flexibility
in the tokbind layer _if_ we wish to explicitly support Fed frameworks in
a similarly flexible fashion.

It would be good to have someone(s) familiar with actual fed deployments
weigh in tho, e.g. our erstwhile co-chairs :)

 > then TP4 needs to
 > verify that TBID4 and TBID1 are both owned by the same client.

agreed.

 > IMO, the easiest way to do this is to have both TBIDs in the same
 > TokenBindingMessage.

nominally agreed given present tokbind design.

 > I'm curious if this scenario (with TC1, TC2,
 > TP3, and TP4) is hypothetical, or if there are real-world setups
 > that work like this where TC1 can't redirect directly to TP4,

SAML, OIDC, and WS-Fed were explicitly designed with the
"AssertionConsumerServiceURL", "redirect_uri", "wreply" (respectively) in
order to accommodate the latter use case.

 > or you
 > can't have TP4 issue a token for TP3, which then issues a token for
 > TC2, which issues a token for TC1 (as Dirk suggests).

that is one possible deployment architecture, but it isn't the only one,
and I don't know how Fed deployment folks at large would view it.

 > I can think of a federated scenario that currently exists where
 > there are multiple token consumers and producers, but it works with a
 > single referred token binding from Include-Referer-Token-Binding-ID.
 >
<details elided>

yes, it appears that the present TBPROTO + HTTPSTB design accommodates that
particular use case.

 > If there are situations where there is a need for TP4 to generate a
 > token for TC1, then I think changes would be needed to TBHTTPS to
 > support that.

Agreed w/latter.  Wrt former, see above.

 > One such change could be for Include-Referer-Token-Binding-ID to pass
 > along all TBIDs from the previous request instead of just one. This
 > would only work if there was a single chain of redirects from TC1 all
 > the way to TP4. Once TP4 receives this TokenBindingMessage with
 > TBID1, TBID2, TBID3, and TBID4 (and verifies all of them), it could
 > issue a token that is bound to all of them, and then TC1 iterates
 > through the bound TBIDs to find one that it recognizes.

I was toying with a similar idea and it seemed to me that the set of TBIDs
conveyed in the TBMSG to whatever server could possibly grow unbounded...

HTH

=JeffH

---

From: Nick Harper <[email-masked]>
Date: Tue, 29 Mar 2016 10:26:12 -0700

On Tue, Mar 29, 2016 at 8:46 AM, =JeffH <[email-masked]>
wrote:

> This won't grow more than whatever the browser's redirect limit is (in
Chrome this is 20), since this would only apply for a single chain of
redirects.

---

From: Leif Johansson <[email-masked]>
Date: Tue, 29 Mar 2016 20:53:49 +0200

> weigh in tho, e.g. our erstwhile co-chairs :)

Jeff just posted to the refeds list (excellent idea Jeff) where there
are lots of folks similarly afflicted - lets see what that yields!

	Cheers Leif

---

From: Dirk Balfanz <[email-masked]>
Date: Tue, 29 Mar 2016 20:31:03 +0000

What's refeds, and how do I join that mailing list?

Dirk.

On Tue, Mar 29, 2016 at 12:27 PM Leif Johansson <[email-masked]> wrote:

> _______________________________________________
> Unbearable mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/unbearable
>

---

From: Leif Johansson <[email-masked]>
Date: Tue, 29 Mar 2016 23:58:15 +0200

> What's refeds, and how do I join that mailing list?

https://refeds.org/ - is a community of (mainly) R&E federation
operators and global research infrastructure operators (think
CERN, ESS etc) mostly talking about global deployment and policy
issues

list info page: https://lists.refeds.org/sympa/info/refeds

> Dirk.
> 
> On Tue, Mar 29, 2016 at 12:27 PM Leif Johansson <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
> 
>     [email-masked] <mailto:[email-masked]>