CIBA Pairwise Identifiers Structuring Text

[Axel Nennker]

Should the text regarding Pairwise Identifiers be in its own section or should it stay in the sections on polling and notification?

Polling: https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.1.1 Notification: https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?Submit=Submit&format=ascii&mode=html&type=ascii&url=https://bitbucket.org/openid/mobile/raw/tip/draft-mobile-client-initiated-backchannel-authentication.xml?at=default#rfc.section.3.5.3.3

References to other specs: Core: https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg Validation of sector_identifier: https://openid.net/specs/openid-connect-registration-1_0.html#SectorIdentifierValidation

Axel

[Axel Nennker]

Hi all,

I created https://bitbucket.org/openid/mobile/issues/52/ciba-pairwise-identifiers-structuring-text to keep track of this.

In pseudo code the calculation of sub could look like this:

// Client is authenticated at this point
If (client.sector_identifier) then 
  // if we have a registered client identifier then use it
  sub = SHA-256 ( client.sector_identifier || local_account_id || salt );
else 
  //need to determine sector_identifier to use as non is registered for this Client
  If (request_object && client.jwks_uri) then
    // request object signature is valid and key from client.jwks_uri was used to sign it
    sub = SHA-256 ( client.jwks_uri || local_account_id || salt );
  else 
    // no registered sector_identifier, no request_object
    if (client.notification_uri) then
      // not polling but notification mode
      sub = SHA-256 ( client.notification_uri || local_account_id || salt );
    else
      // polling mode but not sector_identifier registered 
      response.setError(“invalid_request”);
      logError(“invalid_request”, “no sector identifier for %s”, client.id);
      return;
    endif
  endif
endif
// have sub that is a pairwise identifier here

Having said all that I currently tend to change the spec to say: “In CIBA the Client MUST specify the sector_identifier_uri at registration time if the OP uses Pairwise Identifiers which is strongly recommended”.

Should we make sector_identifier_uri mandatory for CIBA and cull all other Pairwise Identifier text?

Cheers Axel

[Gonzalo Fernández]

I agree!

[Gonzalo Fernández]

I agree that sector_identifier_uri MUST be specified by the client when Pairwise identifiers is used.

[John Bradley]

This is not resolved unless there is some way to verify the sector identifier.

[John Bradley]

Issue not resolved unless there is some way for the AS to verify the sector identifier. With post post back there is no verification as there is no redirect_uri used.

[Gonzalo Fernández]

A proposal from John is to allow using Pairwise Pseudonymous Identifiers only in the case a jwks_uri is registered when the grant-type backchannel_request is registered. In that case the client could use PPIDs as long as it uses mutual TLS authentication to authenticate the token endpoint or the private_key_jwt defined in section 9 of the OpenID core spec. Additiionally it would be OPTIONAL to use signed request object in CIBA authentication requests.

[Gonzalo Fernández]

Mutual TLS authentication to the token endpoint was added to the spec, so Clients that registers a jwks_uri when using the backchannel_request grant_type can use this uri as a verified sector identifier and so that they can use PPIDs.

[Gonzalo Fernández]

The commit #32a8a30 adds a "Registration" section that shows How To Use PPIDs when using Polling mechanism. In the #587ee61 commit we ammend the spec adding using mutual tls or private_key_jwt to authenticate the "Token Endpoint" as mandatory to use PPIDs.

[Gonzalo Fernández]

The commit #32a8a30 adds a "Registration" section that shows How To Use PPIDs when using Polling mechanism. In the #587ee61 commit we ammend the spec adding using mutual tls or private_key_jwt to authenticate the "Token Endpoint" as mandatory to use PPIDs.