[Native App SSO] No prescriptive restriction on the authorization server to protect an actor-less token exchange

Originally submitted by Vivek Shankar (Vivek Shankar) on 2023-12-06

Thank you for the OpenID Native App SSO spec. It solves a real-world problem. I have a proposed update to this spec.

REF: https://openid.net/specs/openid-connect-native-sso-1_0-ID1.html#section-4.3

The native app SSO flow’s token exchange profile expects the actor token is going to somehow be mandatory. However, OAuth 2.0 token exchange does not mandate that the actor token is required. Should this perhaps be prescriptive? For example, if the ds_hash claim is present in the subject token, the corresponding device_secret must be provided as an actor token.

Given the spec hinges on the pairing of the id_token and the device_secret for the token exchange profile, this seems important to prescribe. This is necessary, IMHO, to avoid badly written clients just using the id_token to obtain an access token, which is the ultimate goal for those client apps.

Failing to have something like this in place forces OPs to come up with their own bespoke enforcement. Not having some form of enforcement, IMO, can cause inadvertent exposure in a real implementation.

Bitbucket status: open

Bitbucket origin: issue 2101

Start with section 4.3 of the OpenID Native App SSO specification, especially its token exchange profile and the relationship between the id_token, ds_hash, device_secret, subject token, and actor token. Review the six existing comments for the agreed direction. Done means the specification prescriptively requires the intended actor-token protection, or clearly resolves why it should not.