RE: Comments: Advanced Message Queuing Protocol (AMQP), Claims-based Security

[Brian Raymor <Brian.Raymor@microsoft.com>]

Hi Lorenz,

I was just reading through Working Draft 01 of the Advanced Message Queuing Protocol (AMQP) Claims-based Security Version 1.0 and had a couple of comments/questions.  I hope you find this feedback useful.

I’m a new editor on CBS and recently published an updated Working Draft 03:

https://www.oasis-open.org/apps/org/workgroup/amqp/download.php/60412/amqp-cbs-v1.0-wd03.doc

* Section 2.2 says "Each AMQP container MUST provide a Claims-Based Security Node [...]" shouldn't that be    something like "Each AMQP container conforming to this specification MUST provide a Claims-Based Security Node [...]"?

The current text is a bit more precise:

Resource Manager:

A Resource Manager is an AMQP container that is managing AMQP nodes and using claims-based security to authorize access to them. A CBS-based message broker managing queues is an example of a Resource Manager.

 

Claims-based Security Node:

A claims-based security Node (CBS Node) is an AMQP endpoint responsible for managing tokens. Each Resource Manager MUST provide a CBS Node with the address “$cbs”.

* In section 4.1.1 it is not clear to me what the "audience" of a token is.  Could this be expanded?

 I had a similar thought and previously opened - https://issues.oasis-open.org/browse/AMQP-107

* In section 4.1.2 it specifies the return codes 200, 400, and 500. Is it really meant to be those specific codes or is it 2xx, 4xx,and 5xx?

This is no longer relevant, because the design has changed to use disposition outcomes.

* Both request messages (4.1.1 and 4.2.1) have keys in lower case with the exception of "Type" which is upper case.  Is this on purpose?

I pinged one of the earlier editors and opened - https://issues.oasis-open.org/browse/AMQP-115

* I guess from the places where it talks about sending a refreshed token in section 3 that it is okay to put the same token twice. I think this should be mentioned explicitly.

 I can add that to put-token - https://issues.oasis-open.org/browse/AMQP-116

* Am I correct in assuming that the tokens apply to all links associated with the connection?  Can you limit the scope of a token to only a single session or link?

* I don't see where it is specified what the interaction of two different connections is.  What happens if they put the same token? Can one connection delete the token of another?  My guess is that they should be completely segregated but I think this should be defined explicitly in the specification.

It is connection-scoped. See also - https://issues.oasis-open.org/browse/AMQP-109

Thanks for the feedback,

…Brian