<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>I find it interesting that both the CAS user list and the Shib list are both talking about JWT at the same time.</div>
<div><br>
</div>
<div>And I have devs asking me about CAS and JWT (internally we are CAS shop).</div>
<div><br>
</div>
<div>Frankly the whole SSO world is fragmented, so many solutions to the same problem, muddled by client side javascript, big players like google and microsoft and all that old legacy stuff (custom and commercial).</div>
<div><br>
</div>
<div>Then we throw in MFA / 2FA.</div>
<div><br>
</div>
<div>Anyway, is JWT a fad or a serious contender?</div>
<div><br>
</div>
<div>-Bryan</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span><Klingenstein>, Nate <<a href="mailto:nklingenstein@calstate.edu">nklingenstein@calstate.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, October 6, 2016 at 2:50 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>[Ext] Re: use of JWT and / or STS with Shibboleth IDP?<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div>
<blockquote type="cite" class="">
<div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Nate
- you said you had reservations about JWT. Can you share your thinking? It can be out of band if you'd rather.</span></div>
</blockquote>
</div>
<br class="">
<div class="">This is not deeply uninformed, but I've gone down in writing with worse.</div>
<div class=""><br class="">
</div>
<div class="">Things I don't like:</div>
<div class=""><br class="">
</div>
<div class="">A) 3-character fields in the tokens themselves</div>
<div class="">B) Base 64 encoding with a special character delimiter(the period . ) and fixed "A.B.C" without any indication about what A, B, or C is, or any way to change it</div>
<div class=""><br class="">
</div>
<div class=""><a href="https://scotch.io/tutorials/the-anatomy-of-a-json-web-token" class="">https://scotch.io/tutorials/the-anatomy-of-a-json-web-token</a></div>
<div class=""><br class="">
</div>
<div class="">C) If you're using OAuth, why not just use the built-in bearer tokens?</div>
</div>
</div>
</span>
</body>
</html>