xmlgrrl/UMA-Specifications — Issue #48: Remove IP address hint from host to AM?
Author: xmlgrrl
Created: 2012-02-09 21:17:37+00:00
State: open

Discussed in email thread (http://groups.google.com/group/kantara-initiative-uma-wg/browse_frm/thread/e59373ead388f909):

3) Section 3.3: What is the purpose of including the requester's IP address to be included in token status request? The last sentence in paragraph 2 says it is "advisory only" - does this mean that its inclusion in the request is a suggestion (ie, "MAY include the IP address")?

(See the thread for more discussion.)

In UMA telecon 2012-02-09 we discussed and resolved this issue:

We already allow the AM to assess whatever factors it wants in assessing the viability of the requester's request for permission. Do we need to invent the equivalent of an "Advice" bucket a la SAML for the host's communications with the AM? Or does the ability to extend the JSON structure at various points suffice for this kind of extensibility.

When it comes to proxying, there are standard things that get looked at for security analysis: XSF header, IP address, etc. Who is responsible for determining whether the resource should be provided to the requester? The AM's responsibility includes claims-checking and possibly other requester-independent factors, such as time of day. The AM is not in a position to test any host-dependent factors that the host has not otherwise informed it about (that is, fine-grained access issues outside of whatever was exposed in the scope desciptions that were registered). The AM also isn't in a position to trust the host if it conveys its observed context about the requester, since the host and requester might be colluding. The only thing the AM can trust the host for is host-dependent factors, and this could be handled in extensions as necessary.

So we're agreed to remove the IP address piece.