Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Signed Request Object section to CAMARA Security and Interoperability Profile #233

Closed
wants to merge 1 commit into from
Closed

Add Signed Request Object section to CAMARA Security and Interoperability Profile #233

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions documentation/CAMARA-Security-Interoperability.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,22 @@ All network connections MUST use TLS 1.2 or better.

The OIDC Authorization Code Flow is defined in [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html)

### Signed Request Object

It is RECOMMENDED to use signed Request Object, a [JSON Web Token (JWT) \[RFC7519\]](https://www.rfc-editor.org/rfc/rfc7519.html), passed by value, as specified by [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests) and [\[RFC9101\]](https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
It is RECOMMENDED to use signed Request Object, a [JSON Web Token (JWT) \[RFC7519\]](https://www.rfc-editor.org/rfc/rfc7519.html), passed by value, as specified by [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests) and [\[RFC9101\]](https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2).
It is RECOMMENDED to use a signed request object as specified by [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html#JWTRequests) [pass the signed request object by value](https://openid.net/specs/openid-connect-core-1_0.html#RequestObject).


The `sub` (Subject) claim in the signed Request Object MUST NOT be present, to prevent [cross-JWT confusion](https://www.rfc-editor.org/rfc/rfc9101.html#name-cross-jwt-confusion).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The `sub` (Subject) claim in the signed Request Object MUST NOT be present, to prevent [cross-JWT confusion](https://www.rfc-editor.org/rfc/rfc9101.html#name-cross-jwt-confusion).

sub is not part of https://openid.net/specs/openid-connect-core-1_0.html#RequestObject


The value of `aud` (Audience) claim MUST be the Authorization endpoint as RECOMMENDED by [\[RFC9101\]](https://www.rfc-editor.org/rfc/rfc9101.html#name-explicit-endpoints).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The value of `aud` (Audience) claim MUST be the Authorization endpoint as RECOMMENDED by [\[RFC9101\]](https://www.rfc-editor.org/rfc/rfc9101.html#name-explicit-endpoints).
The value of `aud` (Audience) claim MUST be set to a value that the authorization server accepts as itself.
This document recommends in the [client credentials section](https://github.com/camaraproject/IdentityAndConsentManagement/blob/main/documentation/CAMARA-Security-Interoperability.md#client-authentication) that the `aud` value SHOULD be the URL of the Authorization Server's [Token Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint). The same recommendation is given for the `aud` value of the signed request object.


The following query string parameters of the authorization request URI are REQUIRED, the rest of the [request parameters](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) are OPTIONAL:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The following query string parameters of the authorization request URI are REQUIRED, the rest of the [request parameters](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) are OPTIONAL:

Does this section change what is defined in OIDC?
The request parameter cannot be REQUIRED if the signed request object is RECOMMENDED.
Can this section be removed because no change to OIDC?

- `request`
- `client_id`
- `response_type`
- `scope`
- `redirect_uri`
- `state`

### Cross-Site Request Forgery Protection

CAMARA REQUIRES cross-site request forgery (CSRF) protection.
Expand Down