3 ms·
This is unfortunate but it is not a requirement of OAuth with certificates or with the OAuth MTLS RFC. It may just be lousy policy on part of those government s
by dwaite 5y ago
This is unfortunate but it is not a requirement of OAuth with certificates or with the OAuth MTLS RFC. It may just be lousy policy on part of those government services.
The only time you should need actual certificates (e.g. trust chain with attributes) is when you have multiple authorization servers run by independent organizations. In that case, a central party may do certificate issuance so that each AS can tell that the client has been centrally vetted.
In all other cases, any use of certificates is because they provide a pocket in which to store a public key. A self-signed certificate is just as good for authentication (proving you are the same party as before), because it is the crypto challenge that is important.
For actual certificate issuance, we are unfortunately in a gap between browsers killing off the <keygen> tag and easy adoptability of newer schemes like ACMEv2. Providing public keys via password-protected zipped PDF files has me thinking that their solution for this problem was possibly ill-conceived, and they are issuing private keys for import rather than using CSRs at all.
Note that for multiple AS systems, one common pattern is to use dynamic client registration from OAuth, which was extended to support software statements. In this way the certificate can be used to get local, non-certificate-based client credentials with a particular AS.
The grants being opaque at the API level is unfortunately a common function of authentication and security functions - they don't want to tell you the thing you did wrong, and that is sometimes used as justification for making the errors mostly pointless. A good AS should have some focus on providing more information within transaction logs. However, if the certificates are being shared over MTLS rather than through JWTs the amount of error information is unfortunately more commonly constrained due to infrastructure layering.