search

AMWA-TV / bcp-003

AMWA BCP-003 Security recommendations for NMOS APIs
https://specs.amwa.tv/bcp-003
Apache License 2.0
3 stars 3 forks source link

BCP-003-02: Review requirements on IS-04 based upon IS-10 token changes #56

Closed andrewbonney closed 4 years ago

andrewbonney commented 4 years ago

IS-10 made the token client_id optional for compatibility reasons, but this is depended upon by BCP-003-02. Either adding azp claim support or using the sub may be ways around this.

In addition, the text in BCP-003-02 needs to be clearer that any sub-resources of a Node which a registered/updated/deleted need to be checked against the client_id which was used for the initial Node registration.

andrewbonney commented 4 years ago

From the existing spec, token attributes are used as follows:

iss: Address of the Authorization Server which issued the token sub: A reference to the user who authorised the generation of the access token client_id: A reference to the client which holds the token

Of the above, the only one which makes sense to use in the context of protecting a client's registered IS-04 resources is the client_id as this is intrinsically linked to the client, and can't change if a new user or server authorises that client in the future.

Based on that I'll adjust this document and the IS-10 spec to ensure that one of client_id or OIDC's azp are present and checked against.