Subject: [OAUTH-WG] Does an assertion belong to a client?

From: Laurens Van Houtven <[email-masked]>
Date: Mon, 13 Sep 2010 21:10:57 +0200

Should implementors of OAuth libraries enforce that an assertion belongs to
a particular client?

E.g.: if there are two clients cA and cB, and cA gets issued an assertion
foo, can cB then use foo to obtain an access token at the token endpoint?

thanks
lvh

---

From: Brian Campbell <[email-masked]>
Date: Tue, 14 Sep 2010 16:28:05 -0600

It really depends on the requirements or policy of the authorization
server.  For the I-D I've been working on,
https://datatracker.ietf.org/doc/draft-campbell-oauth-saml/, there's
nothing that binds of the assertion to the client.  So there's not a
requirement for that enforcement nor is there really any information
in the assertion that would make it possible.

Other profiles might be different in that regard and I'd think that
any "client assertions" used for client authentication might directly
identity the client and expect validation of such at the authz server.

On Mon, Sep 13, 2010 at 1:10 PM, Laurens Van Houtven <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>