search

oauth-wg / oauth-transaction-tokens

MIT License
7 stars 10 forks source link

Authorization details presentation and processing #58

Closed gffletch closed 5 months ago

gffletch commented 6 months ago

PR #57 raised a number of issues around processing of authorization details

  1. How are these details determined by the Transaction Token Service (i.e. where do they come from)?
  2. Should all the azd claims be visible to all workloads? or should they be restricted to a subset of workloads?
  3. Who is authoritative for specifying the claims of the azd object
tulshi commented 6 months ago

Some thoughts:

  1. I think the spec should be un-opinionated about how the TraT service generates the value of azd claim. I can see in some instances that the requester has more control over what goes into the claim, and in some cases, the TraT service has more control.
  2. A TraT service could implement selective disclosure, although we could recommend in the spec that one should implement it by encrypting certain fields. Stating this makes the actual mechanism for selective disclosure outside the scope of the spec.
  3. I believe the TraT service MUST be authoritative for the claims of the azd object, because it is signing the TraT.
gffletch commented 6 months ago

Regarding (1) -- I think we still need a way for the client to pass in data to the TTS that it can use to generate the values. Even if how all that works is out of scope for the specificatio.

Regarding (2) and (3) -- I'm ok with leaving the rules out of scope for the specification. The TTS will be authoritative for the resulting azd object and whether it should be protected in some way or not.

I am curious to hear from others as to their thoughts.

gffletch commented 5 months ago

Suggestion to rename authz_details to request_details and then add a processing rule to the effect of... "The TTS SHOULD propagate the data from the request_details object into claims in the azd object as authorized by the TTS authorization policy for the requesting client"

tulshi commented 5 months ago

This has been fixed AFAIK. Please reopen the issue if it hasn't been fixed by George's PR.