Client Authentication -- Do we need TLS mutual authentication?

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-08-02

It is OK for Web server clients/Aggregators, but it is completely unworkable for Smartphone Apps etc.

Is it not better to replace it with something like PKCE, Token Binding and OS Supported App Attestation where applicable?

---

Bitbucket status: resolved

Bitbucket origin: issue 16

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-08-02

Variable security level seems to be a good idea.

[bitbucket-import-issues]

Originally submitted by dgtonge (Dave Tonge) on 2016-08-10

I agree. For apps, token binding is hopefully the solution

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-09-13

What do you think about the Read Only API? Do we still need token binding or strengthened OAuth as it is written in WD1 enough?

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-09-20

Assigning this ticket to John for strengthening the profile specified in section 5 and 6.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-09-20

Suggests replacing the bullets in 5.2.3 Confidential clients

• shall authenticate the client with client secret to access the Token Endpoint as in Section 4.1.3 of RFC6749;

with

• shall authenticate to the token endpoint using the client_secret_jwt or private_key_jwt method as described in section 9 of [OIDC];
• shall use HMAC SHA-256 algorithm where client_secret_jwt method is used;
• shall use the previously registered algorithm to sign the token where private_key_jwt method is used;

[bitbucket-import-issues]

Originally submitted by ve7jtb (John Bradley) on 2016-09-20

We should also allow mutual TLS for server to server confidential clients.

[bitbucket-import-issues]

Originally submitted by SaschaZeGerman (Sascha Preibisch) on 2016-09-25

Mutual TLS should be allowed for any client (which may also be a server). Some frameworks for clients generate private keys, others customers push them to mobile devices via MDM solutions. They may want to leverage the private keys for those connections.

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-09-29

SaschaZeGerman, we discussed about it two calls ago and assigned to ve7jtb to come up with a separate documentation to how to do the client TLS auth. We currently do not have a good documentation to point to. For the time being, we should just put in a place holder. Basically, the direction is as recorded in #33, i.e.,

Mandate either:

• TLS Mutual Auth to the token endpoint according to [[new_tls_client_auth_doc]]
• JWS Assertion Client Auth to the token endpoint (cf. OIDC.)

[bitbucket-import-issues]

Originally submitted by Nat (Nat Sakimura) on 2016-11-29

Now the draft is available as:

Mutual X.509 Transport Layer Security (TLS) Authentication for OAuth Clients