Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add audience advice #3

Merged
merged 6 commits into from
Oct 15, 2020
Merged

Add audience advice #3

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6765537
Add audience advice
bbockelm Mar 17, 2020
1a44200
Note in the table we have more guidance below
bbockelm Mar 18, 2020
eec8746
Improve the HTCondor-CE URI example
bbockelm Mar 18, 2020
1c9391a
Try to clarify language about audiences
bbockelm Mar 18, 2020
97c87f2
Update language around services
bbockelm Oct 1, 2020
e7eb5e7
Clarify we are simply restating RFC text
bbockelm Oct 12, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions profile.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,22 @@ The contents of the claim may either be a string or URL; we do not currently pro
</tr>
</table>

The `aud` claim provides an explicit statement of the intended audience for the token; it is an important mechanism for restricting the scope of the token to one or more relying parties. Note requiring `aud` is atypical: we believe it is better to have the issuer explicitly state the token may be used by any relying party as opposed to assuming its absence indicates no restrictions.

Relying parties are recommended to accept audiences based on the endpoint name most commonly associated with the provided service.
That is, if a client would want to access the resource `https://wlcg.example.com/base/file.root`, then the recommended audience for the relying party at this endpoint would be:

```
https://wlcg.example.com
```

The audience SHOULD be normalized according to Section 6 of RFC 3986; that is, trailing slashes are discouraged and default ports should not be included. However, the comparison against the value MUST be done as a case sensitive string as specified in Section 4.1.3 RFC 7519.

Audiences of this form are preferred (as opposed to a human-readable "site name" such as `WLCG_Site_Foo`) because the user can derive the correct audience from a given URL then determine the correct token to request.

Note that a given relying party may accept several audiences. For example, a storage server may accept an audience based on a load balanced endpoint it participates in (e.g., `https://redirector.example.com`) in addition to its local hostname (`https://server1.example.com`).

If the relying party provides a non-HTTPS-based service, a URI should be used. For example, a HTCondor-CE running at `condor.example.com` may use an audience of the form `condor:condor.example.com`.

### ID Token Claims

Expand Down