Uploaded image for project: 'Compass '
  1. Compass
  2. COMPASS-7493

Investigate changes in PM-3537: Implement DPoP

    • Type: Icon: Investigation Investigation
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: OIDC DB Auth
    • None

      Original Downstream Change Summary

      This project allows clients authenticating to MongoDB server using OIDC authentication to bind their tokens to a public/private keypair, and demonstrate possession of the private component.

      Description of Linked Ticket

      Epic Summary

      Summary

      This project will extend the Server's understanding of JWT encoded OAuth2 tokens to support RFC9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP). This project will define how clients should acquire sender-constrained access tokens, and how DPoP Proofs should be constructed and validated.

      Motivation

      The IETF standardized RFC9449 in September 2023. This new specification describes how clients can request an access token which is bound to provided asymmetric public key. This binding assures that tokens are "sender constrained". When a Resource Server receives a DPoP constrained token, it can demand the client to furnish a proof signed by the related private key. So long as the client keeps its private key secret, only it will be able to construct this proof.

      DPoP binding will improve the security of our MONGODB-OIDC authentication mechanism, by preventing malicious servers from impersonating their clients to legitimate servers by forwarding access tokens they received in authentication attempts.

      Documentation

      Product Description
      Scope
      Technical Design
      Docs Update

            Assignee:
            Unassigned Unassigned
            Reporter:
            backlog-server-pm Backlog - Core Eng Program Management Team
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated: