Subject: [saag] OAuth Report

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 7 Apr 2016 19:39:52 +0200

-- IETF#95 OAuth Summary --

The OAuth meeting was spent with the work on recently adopted working
group items, particularly on the security attack discovered late last
year by German researchers. This attack is known as the 'Authorization
Server Mix-Up' and I made an announcement about it to the mailing list
at http://www.ietf.org/mail-archive/web/oauth/current/msg15336.html. A
few WG members met with the security researchers late last year in an
attempt to better understand the formal analysis the researchers had done.

In addition, we talked about

- Token Exchange
- OAuth Authorization Server Configuration / Discovery
- Native Apps Best Current Practice Guidance

The Token Exchange specification has not been implemented yet and will
not move forward unless implementations are available.

The 'OAuth Authorization Server Configuration / Discovery' specification
caused some confusion about potential security vulnerabilities. A design
team was formed on this issue to resolve these issues and a first
side-meeting took place during this week where some of these concerns
were discussed and clarified.

The Native Apps BCP is making good progress and code has been made
available for Android and iOS, as reported at
https://www.ietf.org/proceedings/95/slides/slides-95-oauth-4.pdf.

We spoke about a new document 'Resource Indicators', which allows the
client to inform the authorization server about what resource server it
wants to talk to. This allows the authorization server to issue access
tokens that are bound to specific resource servers, which tackles the
problem where access tokens have been re-used at other resource servers.

During the meeting the suggestion was made to produce a new version of
the OAuth core specification to incorporate various security documents
into the main specification. This topic is currently under discussion.

In side meetings we also spoke about the next steps regarding the
proof-of-possession work since there is interest to explore a token
binding solution. A small group of people will work on a document on how
the details could look like.