Hi Hannes, On 12/18/2018 02:51 PM, Hannes Tschofenig wrote:
> ~snip~ > > > Now that I got a response from the OAuth working group (in the sense that I > was thinking about the claims in the access token rather than the parameters > in the response from the AS) I think checking the expires_in field has to be > optional since > * the expires_in parameter is optional, and > * it only has an advisory nature. > > It is useful to send the parameter so that the client can determine when to > request a new access token (for example, via the refresh token) but it is not > absolutely necessary for the protocol operation. In OAuth, the expires_in field is usually used to inform the client how long the access token is valid. If the client uses the access token in a request after the token expired, the RS will reject the request, which usually is not a big problem for the client. In ACE, AS provides the client with keying material for the RS, which is a completely different situation. If the client does not know how long the keying material is valid, it may use outdated keying material to communicate with RS. The expires_in field can be used to inform the client how long the keying material for RS is valid, if the keying material is valid as long as the access token. The main reason to change keying material from time to time is to avoid that it is compromised. I therefore think that it is necessary for the security of the solution that C knows how long the keying material is supposed to be valid. Viele Grüße Steffi _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace
