Subject: [abfab] Comments on draft-ietf-abfab-usability-ui-considerations-04.txt

From: Alejandro Pérez Méndez <[email-masked]>
Date: Thu, 28 Jul 2016 14:06:24 +0200

Hi all,

I've reviewed draft-ietf-abfab-usability-ui-considerations-04. Following you can find my comments. I hope they can help moving this document forward.

Overall I find that the new sections provide better readability and completeness to the document. Good job! The document is even easier to follow, and provides a good guidance for future (and present) developers of ABFAB Identity Selectors. Hence, I consider the document ready for a WGLC, granted some minor comments and doubts I have are addressed or clarified either on the text or on the ML.

#1 On page 9, the text says "If the identity contains no password change URL or helpdesk URL, the identity selector MAY present any corresponding URL from the identity selector instead.". Should this be "...from the identity provider..." instead?

#2 On page 16, section 6.8 deals with storing identities with and without credentials. However, this is also dealt in section 6.1, when talking about the optional information an identity may have associated. Should both texts be merged?

#3 On page 19, section 7.3 is titled "Listing Services and Identities", but it only talks about listing services.

#4 On page 19, section 7.5 says "the identity selector will certainly know when successful (or failed) authentications to a particular service have happened." How does this happen? Is the Identity Selector somehowconnected to the GSS-EAP mechanism in order to obtain such feedback (e.g. D-BUS)? In that case, wouldn't it be worth mentioning that the Identity Selector must be listening for events from the mechanism? Should this communication interface be standardized, or does it depend on the GSS-EAP implementation?
  
#5 On page 20, section 8.1 mentions two new GSS-API extensions. I'm not sure I'm getting their purpose. Are they intended to inform the IdP or other entity? How does they improve error handling? I would appreciate a little more elaboration. Has this suggestion been made to the kitten WG? A reference to the discussion would be appreciated.

In any case, does it make sense to have them listed on an RFC-to-be without providing all their technical information (parameters, expected return values, etc.).

Best regards,
Alejandro