{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/327","labels_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/327/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/327/comments","events_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/327/events","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/327","id":103332628,"number":327,"title":"Registering Service Accounts","user":{"login":"seanmonstar","id":51479,"avatar_url":"https://avatars.githubusercontent.com/u/51479?v=3","gravatar_id":"","url":"https://api.github.com/users/seanmonstar","html_url":"https://github.com/seanmonstar","followers_url":"https://api.github.com/users/seanmonstar/followers","following_url":"https://api.github.com/users/seanmonstar/following{/other_user}","gists_url":"https://api.github.com/users/seanmonstar/gists{/gist_id}","starred_url":"https://api.github.com/users/seanmonstar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanmonstar/subscriptions","organizations_url":"https://api.github.com/users/seanmonstar/orgs","repos_url":"https://api.github.com/users/seanmonstar/repos","events_url":"https://api.github.com/users/seanmonstar/events{/privacy}","received_events_url":"https://api.github.com/users/seanmonstar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/labels/waffle:now","name":"waffle:now","color":"ededed"}],"state":"open","locked":false,"assignee":{"login":"seanmonstar","id":51479,"avatar_url":"https://avatars.githubusercontent.com/u/51479?v=3","gravatar_id":"","url":"https://api.github.com/users/seanmonstar","html_url":"https://github.com/seanmonstar","followers_url":"https://api.github.com/users/seanmonstar/followers","following_url":"https://api.github.com/users/seanmonstar/following{/other_user}","gists_url":"https://api.github.com/users/seanmonstar/gists{/gist_id}","starred_url":"https://api.github.com/users/seanmonstar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanmonstar/subscriptions","organizations_url":"https://api.github.com/users/seanmonstar/orgs","repos_url":"https://api.github.com/users/seanmonstar/repos","events_url":"https://api.github.com/users/seanmonstar/events{/privacy}","received_events_url":"https://api.github.com/users/seanmonstar/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-08-26T18:08:29Z","updated_at":"2015-08-27T06:22:58Z","closed_at":null,"body":"The first part of https://github.com/mozilla/fxa/issues/53, an ability to create client that can have a public/private keypair generated, with the public key saved in our database with the client.\r\n\r\nAs this client doesn't need most of the properties that a typical client does, create a new table, `service_clients`, with the columns `client_id`, `pubkey`, `scope`.\r\n"},"comment":{"url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/comments/135305188","html_url":"https://github.com/mozilla/fxa-oauth-server/issues/327#issuecomment-135305188","issue_url":"https://api.github.com/repos/mozilla/fxa-oauth-server/issues/327","id":135305188,"user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"created_at":"2015-08-27T06:22:58Z","updated_at":"2015-08-27T06:22:58Z","body":">  can have a public/private keypair generated, with the public key saved in our database\r\n\r\nWe should consider using JKUs rather than generating keys and giving them to the client.  This seemed to work nicely for pre-verified tokens in the auth-server [1] and it forces us to do the right thing w.r.t. secret rotation, key revocation, etc.\r\n\r\nI also wonder if we can just list the allowed clients and their JKUs/pubkeys in a config file to start with, rather than using a dynamic table in the database.  There won't be more than a handful of them, and unlike standard client_ids, there's currently no plans to allow people to self-service these credentials.\r\n\r\n[1] https://github.com/mozilla/fxa-auth-server/blob/master/lib/preverifier.js\r\n\r\n"}}