Subject: [OAUTH-WG] Updated shepherd writeup for draft-ietf-oauth-access-token-jwt-09

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 21 Sep 2020 10:57:51 +0000

Hi all,

I updated the shepherd writeup for draft-ietf-oauth-access-token-jwt-09 and included the links to the implementations distributed on the list. I am sure there are more.

While updating the shepherd writeup I noticed that the draft contains a JWT in a style that does not match the format described in RFC 7519.

I was wondering whether we should actually replicate the example in a way similar to Section 6.1 of RFC 7519 (which shows an unsecured JWT) or, even better, a digitally signed JWT.

Here is the snippet from the draft:

   {"typ":"at+JWT","alg":"RS256","kid":"RjEwOwOA"}
   {
     "iss": "https://authorization-server.example.com/",
     "sub": " 5ba552d67",
     "aud":   "https://rs.example.com/",
     "exp": 1544645174,
     "client_id": "s6BhdRkqt3_",
     "scope": "openid profile reademail"
   }

                       Figure 2: A JWT Access Token

What do you think?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Brian Campbell <[email-masked]>
Date: Mon, 21 Sep 2020 09:34:55 -0600

I believe the intent of that example was to show the unencoded header and
body content of the JWT. So perhaps all that's needed is to adjust the text
that introduces the example and the figure title or caption or whatever
it's called to reflect that?

On Mon, Sep 21, 2020 at 4:58 AM Hannes Tschofenig <[email-masked]>
wrote:

> Hi all,
>
>
>
> I updated the shepherd writeup for draft-ietf-oauth-access-token-jwt-09
> and included the links to the implementations distributed on the list. I am
> sure there are more.
>
>
>
> While updating the shepherd writeup I noticed that the draft contains a
> JWT in a style that does not match the format described in RFC 7519.
>
>
>
> I was wondering whether we should actually replicate the example in a way
> similar to Section 6.1 of RFC 7519 (which shows an unsecured JWT) or, even
> better, a digitally signed JWT.
>
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Vittorio Bertocci <[email-masked]>
Date: Tue, 22 Sep 2020 23:38:00 +0000

Thanks to both! I agree this can use more clarity.
I am modifying the figure as in the following, adopting a style closer to 6.1 of 7519 and providing a more descriptive caption.

Header:

Claims:

   {

                       Figure 2: The Header and JWT Claims Set of a JWT Access Token

From: OAuth <[email-masked]> on behalf of Brian Campbell <bcampbell=[email-masked]>
Date: Monday, September 21, 2020 at 08:36
To: Hannes Tschofenig <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] Updated shepherd writeup for draft-ietf-oauth-access-token-jwt-09

I believe the intent of that example was to show the unencoded header and body content of the JWT. So perhaps all that's needed is to adjust the text that introduces the example and the figure title or caption or whatever it's called to reflect that?

On Mon, Sep 21, 2020 at 4:58 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

What do you think?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.