Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Establish a mechanism that allows for other revocation means in the Referenced Token #90

Merged
merged 11 commits into from
Feb 6, 2024
+51 −14
Merged

Establish a mechanism that allows for other revocation means in the Referenced Token #90

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
5aa3ace
move status_list relevant information to its own json object in the r…
c2bo Dec 20, 2023
58e312e
Merge branch 'main' into c2bo/status-reference
c2bo Jan 15, 2024
523c053
cleanup from the merge
c2bo Jan 19, 2024
75116f3
Merge branch 'main' into c2bo/status-reference
c2bo Jan 19, 2024
21dc0f1
more text explaining the status claim
c2bo Jan 22, 2024
066b9ab
adjust registry text
c2bo Feb 2, 2024
f1c76e0
Apply suggestions from code review
c2bo Feb 5, 2024
792c86c
Fix iana registry template
c2bo Feb 5, 2024
341edb1
Update draft-ietf-oauth-status-list.md
c2bo Feb 5, 2024
0987cea
fix references
c2bo Feb 5, 2024
3fcdf5d
Merge branch 'main' into c2bo/status-reference
c2bo Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions draft-ietf-oauth-status-list.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ The following rules apply to validating a JWT-based Status List Token. Applicati

1. The JWT MUST contain an "iss" (issuer) claim that contains a unique string identifier for the entity that issued the JWT. In the absence of an application profile specifying otherwise, compliant applications MUST compare issuer values using the Simple String Comparison method defined in Section 6.2.1 of {{RFC3986}}. The value MUST be equal to that of the "iss" claim contained within the Referenced Token.

2. The JWT MUST contain a "sub" (subject) claim that contains an unique string identifier for that Status List Token. The value MUST be equal to that of the "uri" claim contained in the "status" claim of the Referenced Token.
2. The JWT MUST contain a "sub" (subject) claim that contains an unique string identifier for that Status List Token. The value MUST be equal to that of the "uri" claim contained in the "status_list" claim of the Referenced Token as defined in [](#jwt-referenced-token-status).

3. The JWT MUST contain an "iat" (issued at) claim that identifies the time at which it was issued.

Expand Down Expand Up @@ -155,8 +155,10 @@ The following example is the decoded header and payload of a JWT meeting the pro
{
"iss": "https://example.com",
"status": {
"idx": 0,
"uri": "https://example.com/statuslists/1"
"status_list": {
"idx": 0,
"uri": "https://example.com/statuslists/1"
}
}
}
~~~
Expand All @@ -167,9 +169,13 @@ The following rules apply to validating the "status" (status) claim

1. The claim value MUST be a valid JSON object.

2. The claim value object MUST contain an "idx" (index) member with a numeric value that represents the index to check for status information in the Status List for the current JWT. The value of this member MUST be a non-negative number, containing a value of zero or greater.
2. The claim value object MUST contain a member called "status_list" that signals that status checks for this token can be done using the status list mechanism defined in this document. For the "status_list" object, the following rules apply:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we make this a MUST then won't other future mechanisms only be additional rather than alternatives?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is only a MUST for the mechanism used in the specification. If Giuseppe wants to implement an OCSP-like mechanism than it would look mlike:

"status" : {
  "new-mechanism-name" : {
    "whatever-parameter" : "whatever-value"
  }
}

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that was the intention. For this spec, the existence of status_list is a MUST, but other status mechanisms can reuse the status claim and define other behaviour depending on other claims within status.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we may need some text to the introduction that explains this in more detail. However its more better to merge #89 first and then start working from there


3. The claim value object MUST contain a "uri" member with a string value that identifies the Status List containing the status information for the JWT. The value of this member MUST be a uri conforming to {{RFC3986}}.
1. The claim value MUST be a valid JSON object.

2. The claim value object MUST contain an "idx" (index) member with a numeric value that represents the index to check for status information in the Status List for the current JWT. The value of this member MUST be a non-negative number, containing a value of zero or greater.

3. The claim value object MUST contain a "uri" member with a string value that identifies the Status List containing the status information for the JWT. The value of this member MUST be a uri conforming to {{RFC3986}}.

# Status Types {#status-types}

Expand Down Expand Up @@ -467,6 +473,7 @@ for their valuable contributions, discussions and feedback to this specification

-01

* Change status claim to in referenced token to allow re-use for other mechanisms
* Changing compression from gzip to zlib
* Change typo in Status List Token sub claim description

Expand Down