Welcome to the Consumer Data Right Support Portal

Check out our guides, browse through our FAQs, and post your own questions for Support.

New to the Consumer Data Right? Learn more

Clarification on aud claim for a Data Recipient hosted arrangement revocation endpoint Follow

Comments

4 comments

  • Avatar
    Stuart Low

    This article appears tor redefine the internets definition of a base URI (which is the URL with no query or fragment parameter) into some "morphing" into RecipientBaseURI which contradicts the "end point being called" from the Standards.

    The non-normative examples in the Standards are also misleading and the exact opposite of what this article states (see extract below). The sentence of "because the full path is also the BaseURI" is the direct opposite of what is stated in this article.

    Non-Normative Example - Data Holder calls the Data Recipient's revocation end point (note that the “aud” claim is the fully qualified path to the revocation end point because the full path is also the Base URI).

    POST https://data.recipient.com.au/revocation HTTP/1.1
    Host: data.recipient.com.au
    Content-Type: application/x-www-form-urlencoded
    Authorization: Bearer eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyNDU2In0.ey …
    
    token=45ghiukldjahdnhzdauz&token_type_hint=refresh_token
    
    ## Decoded Bearer token JWT
    {
       "alg":"PS256",
       "typ":"JWT",
       "kid":"67890"
    }
    {
       "iss":"dataholderbrand-123",
       "sub":"dataholderbrand-123",
       "aud":"https://data.recipient.com.au/revocation",
       "iat":1516239022,
       "exp":1516239322,
       "jti":"dba86502-7cf5-4719-9638-c5339a0ddb06"
    }
    1
    Comment actions Permalink
  • Avatar
    Matt Peterson

    Yeah, I'm confused, sorry. This seems to differ from the current standards at https://consumerdatastandardsaustralia.github.io/standards/#data-holders-calling-data-recipients.

    It is very dependent on your definition of base URI. In the example of https://data.recipient.com.au/revocation, I could calculate the base URI as https://data.recipient.com.au/, based on https://tools.ietf.org/html/rfc3986#section-5.1, which is different to both examples given above.

    0
    Comment actions Permalink
  • Avatar
    James Bligh

    The comments here are reasonable.  Initially the standards have used the term "holder path" for this reason.  Over time the use of base URI in discussion has become more prevalent and this has crept into both the register and technical standards.

    This article describes the correct intent of the standards and clarifies aud.  We will raise a change request in standards maintenence to clarify the use of the term base URI and base path in the standards so there is no confusion between the standards and the usage of the same terms in the RFC.

    0
    Comment actions Permalink
  • Avatar
    James Bligh

    Please refer to the following maintenance request:

    https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/373

    1
    Comment actions Permalink

Please sign in to leave a comment.