Skip to content

Commit df4c646

Browse files
selfissuedselfissued
authored
Merge pull request #3 from selfissued/mbj-update-other-specs
Update audience requirements in other RFCs
2 parents 28c114c + 303e316 commit df4c646

File tree

1 file changed

+245
-4
lines changed

1 file changed

+245
-4
lines changed

‎draft-jones-oauth-rfc7523bis.xml‎

Lines changed: 245 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<rfc xmlns:xi="http://www.w3.org/2001/XInclude"
66
category="std" ipr="trust200902"
77
docName="draft-jones-oauth-rfc7523bis-latest"
8-
obsoletes="7523" updates="7521">
8+
obsoletes="7523" updates="7521, 7522, 9126">
99

1010
<?rfc toc="yes"?>
1111
<?rfc tocompact="yes"?>
@@ -694,6 +694,189 @@
694694

695695
</section>
696696
</section>
697+
698+
<section title="Updates to RFC 7521" anchor="RFC7521Updates">
699+
<t>
700+
This section updates
701+
"Assertion Framework for OAuth 2.0 Client Authentication and
702+
Authorization Grants" <xref target="RFC7521"/>
703+
to tighten its audience requirements.
704+
</t>
705+
<t>
706+
The description of the Audience parameter
707+
in Section 5.1 of <xref target="RFC7521"/> (Assertion Metamodel)
708+
is replaced by:
709+
<list style="hanging">
710+
711+
<t hangText="Audience">
712+
<vspace/>
713+
A value that identifies the party intended to process the assertion.
714+
The audience MUST contain the issuer identifier <xref target="RFC8414"/>
715+
of the authorization server as its sole value.
716+
Unlike the audience value specified
717+
in <xref target="RFC7521"/>, there MUST be no value other than
718+
the issuer identifier of the intended authorization server
719+
used as the audience of the assertion;
720+
this includes that the token endpoint URL of the authorization server
721+
MUST NOT be used as an audience value.
722+
</t>
723+
</list>
724+
</t>
725+
<t>
726+
The description of the Audience parameter
727+
in Section 5.2 of <xref target="RFC7521"/> (General Assertion Format and Processing Rules)
728+
is replaced by:
729+
<list style="symbols">
730+
<t>
731+
The assertion MUST contain an audience that identifies the
732+
authorization server as the intended audience,
733+
with the issuer identifier <xref target="RFC8414"/>
734+
of the authorization server as its sole value.
735+
The authorization server MUST reject any assertion that does not
736+
contain its own issuer identifier as the sole audience value.
737+
</t>
738+
</list>
739+
</t>
740+
<t>
741+
In the list of agreements required by participants
742+
in Section 7 of <xref target="RFC7521"/> (Interoperability Considerations),
743+
"Audience identifiers" is removed from the list.
744+
</t>
745+
</section>
746+
747+
<section title="Updates to RFC 7522" anchor="RFC7522Updates">
748+
<t>
749+
This section updates
750+
"Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0
751+
Client Authentication and Authorization Grants" <xref target="RFC7522"/>
752+
to tighten its audience requirements.
753+
</t>
754+
<t>
755+
The description of the Audience element in Item 2 of
756+
Section 3 of <xref target="RFC7522"/> (Assertion Format and Processing Requirements)
757+
is replaced by:
758+
<list style="empty">
759+
<t>
760+
The Assertion MUST contain a &lt;Conditions&gt; element
761+
with an &lt;AudienceRestriction&gt; element
762+
with a single &lt;Audience&gt; element that identifies the
763+
authorization server as the intended audience.
764+
The value of the &lt;Audience&gt; element MUST be
765+
the issuer identifier <xref target="RFC8414"/> of the authorization server.
766+
Section 2.5.1.4 of
767+
"Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0"
768+
<xref target="OASIS.saml-core-2.0-os"/>
769+
defines the &lt;AudienceRestriction&gt; and &lt;Audience&gt; elements.
770+
Unlike the audience value specified in <xref target="RFC7522"/>,
771+
there MUST be no value other than
772+
the issuer identifier of the intended authorization server
773+
used as the audience of the assertion;
774+
this includes that the token endpoint URL of the authorization server
775+
MUST NOT be used as an audience value.
776+
<vspace blankLine="1"/>
777+
778+
The authorization server MUST reject any assertion that does not
779+
contain its own issuer identifier as the sole audience value.
780+
</t>
781+
</list>
782+
</t>
783+
<t>
784+
In Section 4 of <xref target="RFC7522"/> (Authorization Grant Example),
785+
the sentence:
786+
<list style="empty">
787+
<t>
788+
The intended audience of the Assertion is
789+
<spanx style='verb'>https://saml-sp.example.net</spanx>,
790+
which is an identifier for a SAML Service Provider
791+
with which the authorization server identifies itself.
792+
</t>
793+
</list>
794+
is replaced by:
795+
<list style="empty">
796+
<t>
797+
The intended audience of the Assertion is
798+
<spanx style='verb'>https://authz.example.net</spanx>,
799+
which is the authorization server's issuer identifier.
800+
</t>
801+
</list>
802+
</t>
803+
<figure title='Example SAML 2.0 Assertion' anchor='assertion'>
804+
<preamble>
805+
In the same section, the SAML 2.0 Assertion example is replaced by:
806+
</preamble>
807+
<artwork><![CDATA[
808+
<Assertion IssueInstant="2024-11-17T00:53:34.619Z"
809+
ID="ef1xsbZxPV2oqjd7HTLRLIBlBb7"
810+
Version="2.0"
811+
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
812+
<Issuer>https://saml-idp.example.com</Issuer>
813+
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
814+
[...omitted for brevity...]
815+
</ds:Signature>
816+
<Subject>
817+
<NameID
818+
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
819+
[email protected]
820+
</NameID>
821+
<SubjectConfirmation
822+
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
823+
<SubjectConfirmationData
824+
NotOnOrAfter="2024-11-17T00:58:34.619Z"
825+
Recipient="https://authz.example.net/token.oauth2"/>
826+
</SubjectConfirmation>
827+
</Subject>
828+
<Conditions>
829+
<AudienceRestriction>
830+
<Audience>https://authz.example.net</Audience>
831+
</AudienceRestriction>
832+
</Conditions>
833+
<AuthnStatement AuthnInstant="2024-11-17T00:53:34.371Z">
834+
<AuthnContext>
835+
<AuthnContextClassRef>
836+
urn:oasis:names:tc:SAML:2.0:ac:classes:X509
837+
</AuthnContextClassRef>
838+
</AuthnContext>
839+
</AuthnStatement>
840+
</Assertion>
841+
]]></artwork>
842+
</figure>
843+
<t>
844+
In the list of agreements required by participants
845+
in Section 5 of <xref target="RFC7521"/> (Interoperability Considerations),
846+
"Audience identifiers" is removed from the list.
847+
</t>
848+
</section>
849+
850+
<section title="Updates to RFC 9126" anchor="RFC9126Updates">
851+
<t>
852+
This section updates
853+
"OAuth 2.0 Pushed Authorization Requests" <xref target="RFC9126"/>
854+
to tighten its audience requirements.
855+
</t>
856+
<t>
857+
The paragraph describing the audience value
858+
in Section 2 of <xref target="RFC9126"/> (Pushed Authorization Request Endpoint)
859+
is replaced by:
860+
<list style="empty">
861+
<t>
862+
This update resolves the potential ambiguity regarding
863+
the appropriate audience value to use when employing
864+
JWT client assertion-based authentication
865+
(as defined in Section 2.2 of <xref target="RFC7523"/> with the
866+
<spanx style="verb">private_key_jwt</spanx> or
867+
<spanx style="verb">client_secret_jwt</spanx> authentication method names
868+
per Section 9 of <xref target="OpenID.Core"/>)
869+
that was described in <xref target="RFC9126"/>.
870+
To address that ambiguity, the issuer identifier URL
871+
of the authorization server according to <xref target="RFC8414"/>
872+
MUST be used as the sole value of the audience.
873+
The authorization server MUST reject any such JWT that does not
874+
contain its own issuer identifier as the sole audience value.
875+
</t>
876+
</list>
877+
</t>
878+
</section>
879+
697880
</middle>
698881

699882
<back>
@@ -705,9 +888,12 @@
705888
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6749.xml"/>
706889
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7159.xml"/>
707890
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7521.xml"/>
891+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7522.xml"/>
892+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7523.xml"/>
708893
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
709894
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8414.xml"/>
710895
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8725.xml"/>
896+
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9126.xml"/>
711897

712898
<!-- Reference from https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7518.xml with change to anchor="JWA" -->
713899

@@ -741,16 +927,57 @@
741927
<seriesInfo name="DOI" value="10.17487/RFC7519"/>
742928
</reference>
743929

930+
<reference target="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf" anchor="OASIS.saml-core-2.0-os">
931+
<front><title>Assertions and Protocols for the OASIS Security Assertion Markup Language
932+
(SAML) V2.0</title>
933+
<author fullname="Scott Cantor" initials="S." surname="Cantor">
934+
<organization>Internet2</organization>
935+
<address><email>[email protected]</email></address></author>
936+
<author fullname="John Kemp" initials="J." surname="Kemp"><organization>Nokia</organization>
937+
<address><email>[email protected]</email></address></author><author fullname="Rob Philpott" initials="R." surname="Philpott">
938+
<organization>RSA Security</organization>
939+
<address><email>[email protected]</email></address></author>
940+
<author fullname="Eve Maler" initials="E." surname="Maler">
941+
<organization>Sun Microsystems</organization><address><email>[email protected]</email></address></author>
942+
<date year="2005" month="March"/></front>
943+
<seriesInfo name="OASIS Standard" value="saml-core-2.0-os"/>
944+
</reference>
945+
744946
</references>
745947

746948
<references title="Informative References">
747949
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2046.xml"/>
748950
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6755.xml"/>
749951
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6838.xml"/>
750-
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7522.xml"/>
751-
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7523.xml"/>
752952
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7591.xml"/>
753-
<xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9126.xml"/>
953+
954+
<reference anchor="OpenID.Core" target="https://openid.net/specs/openid-connect-core-1_0.html">
955+
<front>
956+
<title>OpenID Connect Core 1.0 incorporating errata set 2</title>
957+
958+
<author fullname="Nat Sakimura" initials="N." surname="Sakimura">
959+
<organization abbrev="NAT.Consulting (was at NRI)">NAT.Consulting</organization>
960+
</author>
961+
962+
<author fullname="John Bradley" initials="J." surname="Bradley">
963+
<organization abbrev="Yubico (was at Ping Identity)">Yubico</organization>
964+
</author>
965+
966+
<author fullname="Michael B. Jones" initials="M.B." surname="Jones">
967+
<organization abbrev="Self-Issued Consulting (was at Microsoft)">Self-Issued Consulting</organization>
968+
</author>
969+
970+
<author fullname="Breno de Medeiros" initials="B." surname="de Medeiros">
971+
<organization abbrev="Google">Google</organization>
972+
</author>
973+
974+
<author fullname="Chuck Mortimore" initials="C." surname="Mortimore">
975+
<organization abbrev="Disney (was at Salesforce)">Disney</organization>
976+
</author>
977+
978+
<date day="15" month="December" year="2023"/>
979+
</front>
980+
</reference>
754981

755982
<reference anchor="OpenID.Registration" target="https://openid.net/specs/openid-connect-registration-1_0.html">
756983
<front>
@@ -855,6 +1082,20 @@
8551082
<t>
8561083
Explicitly typed authorization grant JWTs and client authentication JWTs.
8571084
</t>
1085+
<t>
1086+
Update audience requirements in
1087+
"Assertion Framework for OAuth 2.0 Client Authentication and
1088+
Authorization Grants" <xref target="RFC7521"/>.
1089+
</t>
1090+
<t>
1091+
Update audience requirements in
1092+
"Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0
1093+
Client Authentication and Authorization Grants" <xref target="RFC7522"/>.
1094+
</t>
1095+
<t>
1096+
Update audience requirements in
1097+
"OAuth 2.0 Pushed Authorization Requests" <xref target="RFC9126"/>.
1098+
</t>
8581099
</list>
8591100
</t>
8601101

0 commit comments

Comments
 (0)