Skip to content

Commit 28c114c

Browse files
selfissuedselfissued
authored
Merge pull request #2 from selfissued/mbj-explicit-typing
Explicitly type JWTs
2 parents bb89931 + 5b124d7 commit 28c114c

File tree

1 file changed

+205
-14
lines changed

1 file changed

+205
-14
lines changed

‎draft-jones-oauth-rfc7523bis.xml‎

Lines changed: 205 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -189,8 +189,9 @@
189189
Content-Type: application/x-www-form-urlencoded
190190
191191
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
192-
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.
193-
eyJpc3Mi[...omitted for brevity...].
192+
&assertion=eyJ0eXAiOiJhdXRob3JpemF0aW9uLWdyYW50K2p3dCIsImFsZyI6Ik
193+
VTMjU2Iiwia2lkIjoiMTYifQ.
194+
eyJhdWQiOiJodHRwczovLw[...omitted for brevity...].
194195
J9l-ZhwP[...omitted for brevity...]
195196
]]></artwork>
196197
</figure>
@@ -220,8 +221,9 @@
220221
code=n0esc3NRze7LTCu7iYzS6a5acc3f0ogp4&
221222
client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3A
222223
client-assertion-type%3Ajwt-bearer&
223-
client_assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6IjIyIn0.
224-
eyJpc3Mi[...omitted for brevity...].
224+
client_assertion=eyJ0eXAiOiJjbGllbnQtYXV0aGVudGljYXRpb24rand0Iiwi
225+
YWxnIjoiUlMyNTYiLCJraWQiOiIyMiJ9.
226+
eyJhdWQiOiJodHRwczovLw[...omitted for brevity...].
225227
cC4hiUPo[...omitted for brevity...]
226228
]]></artwork>
227229
</figure>
@@ -240,6 +242,15 @@
240242
<t>
241243
<list style="numbers">
242244

245+
<t>
246+
The JWT MUST be explicitly typed,
247+
as defined in Section 3.11 of <xref target="RFC8725"/>.
248+
The <spanx style="verb">typ</spanx> header parameter values
249+
that MUST be used are defined in <xref target="GrantProcessing"/>
250+
and <xref target="ClientProcessing"/>.
251+
The authorization server MUST reject JWTs that do not use
252+
the specified explicit type value.
253+
</t>
243254
<t>
244255
The JWT MUST contain an <spanx style="verb">iss</spanx>
245256
(issuer) claim that contains a unique identifier for the
@@ -339,6 +350,13 @@
339350

340351
<section title="Authorization Grant Processing" anchor="GrantProcessing">
341352

353+
<t>
354+
Authorization grant JWTs MUST be explicitly typed by using the
355+
<spanx style="verb">typ</spanx> header parameter value
356+
<spanx style="verb">authorization-grant+jwt</spanx>.
357+
Authorization grant JWTs not using this explicit type value
358+
MUST be rejected by the authorization server.
359+
</t>
342360
<t>
343361
JWT authorization grants may be used with or without client authentication
344362
or identification. Whether or not client authentication is needed in
@@ -373,6 +391,13 @@
373391

374392
<section title="Client Authentication Processing" anchor="ClientProcessing">
375393

394+
<t>
395+
Client authentication JWTs MUST be explicitly typed by using the
396+
<spanx style="verb">typ</spanx> header parameter value
397+
<spanx style="verb">client-authentication+jwt</spanx>.
398+
Client authentication JWTs not using this explicit type value
399+
MUST be rejected by the authorization server.
400+
</t>
376401
<t>If the client JWT is not valid, the
377402
authorization server constructs an error response as defined in
378403
OAuth 2.0 <xref target="RFC6749"/>.
@@ -414,13 +439,14 @@
414439

415440
<figure>
416441
<preamble>
417-
The following example JSON object, used as the header of a
418-
JWT, declares that the JWT is signed with the Elliptic Curve
419-
Digital Signature Algorithm (ECDSA) P-256
420-
SHA-256 using a key identified by the <spanx style="verb">kid</spanx> value <spanx style="verb">16</spanx>.
442+
The following example JSON object, used as the header parameters of a JWT,
443+
declares that the JWT is an authorization grant JWT,
444+
is signed with the Elliptic Curve Digital Signature Algorithm (ECDSA) P-256 with SHA-256,
445+
and was signed with a key identified by
446+
the <spanx style="verb">kid</spanx> value <spanx style="verb">16</spanx>.
421447
</preamble>
422448
<artwork><![CDATA[
423-
{"alg":"ES256","kid":"16"}
449+
{"typ":"authorization-grant+jwt","alg":"ES256","kid":"16"}
424450
]]></artwork>
425451
</figure>
426452

@@ -436,8 +462,9 @@
436462
Content-Type: application/x-www-form-urlencoded
437463
438464
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
439-
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.
440-
eyJpc3Mi[...omitted for brevity...].
465+
&assertion=eyJ0eXAiOiJhdXRob3JpemF0aW9uLWdyYW50K2p3dCIsImFsZyI6Ik
466+
VTMjU2Iiwia2lkIjoiMTYifQ.
467+
eyJhdWQiOiJodHRwczovLw[...omitted for brevity...].
441468
J9l-ZhwP[...omitted for brevity...]
442469
]]></artwork>
443470
</figure>
@@ -516,8 +543,156 @@
516543
established by
517544
"An IETF URN Sub-Namespace for OAuth" <xref target="RFC6755"/>
518545
were performed by <xref target="RFC7523"/>.
519-
No IANA actions are requested by this specification.
520546
</t>
547+
548+
<section title="Media Type Registration" anchor="MediaReg">
549+
<t>
550+
This section registers the following media types <xref target="RFC2046"/>
551+
in the "Media Types" registry <xref target="IANA.MediaTypes"/>
552+
in the manner described in <xref target="RFC6838"/>.
553+
</t>
554+
555+
<section title="Registry Contents" anchor="MediaContents">
556+
<t>
557+
<?rfc subcompact="yes"?>
558+
<list style="symbols">
559+
<t>
560+
Type name: application
561+
</t>
562+
<t>
563+
Subtype name: authorization-grant+jwt
564+
</t>
565+
<t>
566+
Required parameters: n/a
567+
</t>
568+
<t>
569+
Optional parameters: n/a
570+
</t>
571+
<t>
572+
Encoding considerations: binary;
573+
An authorization grant JWT is a JWT;
574+
JWT values are encoded as a
575+
series of base64url-encoded values (some of which may be the
576+
empty string) separated by period ('.') characters.
577+
</t>
578+
<t>
579+
Security considerations: See <xref target="Security"/> of this specification
580+
</t>
581+
<t>
582+
Interoperability considerations: n/a
583+
</t>
584+
<t>
585+
Published specification: <xref target="GrantProcessing"/> of this specification
586+
</t>
587+
<t>
588+
Applications that use this media type:
589+
Applications that use this specification
590+
</t>
591+
<t>
592+
Fragment identifier considerations: n/a
593+
</t>
594+
<t>
595+
Additional information:<list style="empty">
596+
<t>Magic number(s): n/a</t>
597+
<t>File extension(s): n/a</t>
598+
<t>Macintosh file type code(s): n/a </t></list>
599+
<vspace/>
600+
</t>
601+
<t>
602+
Person &amp; email address to contact for further information:
603+
<vspace/>
604+
Michael B. Jones, [email protected]
605+
</t>
606+
<t>
607+
Intended usage: COMMON
608+
</t>
609+
<t>
610+
Restrictions on usage: none
611+
</t>
612+
<t>
613+
Author: Michael B. Jones, [email protected]
614+
</t>
615+
<t>
616+
Change controller: OpenID Foundation Artifact Binding Working Group - [email protected]
617+
</t>
618+
<t>
619+
Provisional registration? No
620+
</t>
621+
</list>
622+
<?rfc subcompact="no"?>
623+
</t>
624+
625+
<t>
626+
<?rfc subcompact="yes"?>
627+
<list style="symbols">
628+
<t>
629+
Type name: application
630+
</t>
631+
<t>
632+
Subtype name: client-authentication+jwt
633+
</t>
634+
<t>
635+
Required parameters: n/a
636+
</t>
637+
<t>
638+
Optional parameters: n/a
639+
</t>
640+
<t>
641+
Encoding considerations: binary;
642+
A client authentication JWT is a JWT;
643+
JWT values are encoded as a
644+
series of base64url-encoded values (some of which may be the
645+
empty string) separated by period ('.') characters.
646+
</t>
647+
<t>
648+
Security considerations: See <xref target="Security"/> of this specification
649+
</t>
650+
<t>
651+
Interoperability considerations: n/a
652+
</t>
653+
<t>
654+
Published specification: <xref target="ClientProcessing"/> of this specification
655+
</t>
656+
<t>
657+
Applications that use this media type:
658+
Applications that use this specification
659+
</t>
660+
<t>
661+
Fragment identifier considerations: n/a
662+
</t>
663+
<t>
664+
Additional information:<list style="empty">
665+
<t>Magic number(s): n/a</t>
666+
<t>File extension(s): n/a</t>
667+
<t>Macintosh file type code(s): n/a </t></list>
668+
<vspace/>
669+
</t>
670+
<t>
671+
Person &amp; email address to contact for further information:
672+
<vspace/>
673+
Michael B. Jones, [email protected]
674+
</t>
675+
<t>
676+
Intended usage: COMMON
677+
</t>
678+
<t>
679+
Restrictions on usage: none
680+
</t>
681+
<t>
682+
Author: Michael B. Jones, [email protected]
683+
</t>
684+
<t>
685+
Change controller: OpenID Foundation Artifact Binding Working Group - [email protected]
686+
</t>
687+
<t>
688+
Provisional registration? No
689+
</t>
690+
</list>
691+
<?rfc subcompact="no"?>
692+
</t>
693+
</section>
694+
695+
</section>
521696
</section>
522697
</middle>
523698

@@ -532,6 +707,7 @@
532707
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7521.xml"/>
533708
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
534709
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8414.xml"/>
710+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8725.xml"/>
535711

536712
<!-- Reference from https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7518.xml with change to anchor="JWA" -->
537713

@@ -568,7 +744,9 @@
568744
</references>
569745

570746
<references title="Informative References">
747+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2046.xml"/>
571748
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6755.xml"/>
749+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6838.xml"/>
572750
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7522.xml"/>
573751
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7523.xml"/>
574752
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7591.xml"/>
@@ -644,6 +822,16 @@
644822
</front>
645823
</reference>
646824

825+
<reference anchor="IANA.MediaTypes" target="https://www.iana.org/assignments/media-types">
826+
<front>
827+
<title>Media Types</title>
828+
<author>
829+
<organization>IANA</organization>
830+
</author>
831+
<date/>
832+
</front>
833+
</reference>
834+
647835
</references>
648836

649837
<section title="Document History" anchor="History">
@@ -661,9 +849,12 @@
661849
removing the IANA actions already performed,
662850
and adding the Document History section.
663851
</t>
664-
<t>
852+
<t>
665853
Use AS issuer identifier as the sole audience value.
666-
</t>
854+
</t>
855+
<t>
856+
Explicitly typed authorization grant JWTs and client authentication JWTs.
857+
</t>
667858
</list>
668859
</t>
669860

0 commit comments

Comments
 (0)