Subject: [oauth] WG kickoff

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 29 May 2009 14:28:42 -0600

Welcome to the IETF's OAuth WG!

This list will be the primary venue for discussions related to the work
items defined in our charter:

http://www.ietf.org/html.charters/oauth-charter.html

(Naturally, work on non-charter items will continue in parallel via
other discussion venues, see <http://oauth.net/> for details.)

Please note that we have some nifty tools here:

http://tools.ietf.org/wg/oauth/

The tools at our disposal include issue tracking, wiki pages, and links
to this list, our charter, and the chatroom logs. To get a good idea of
how we can use these tools, check out the site of the HTTPBIS WG:

http://tools.ietf.org/wg/httpbis/

As co-chairs, Blaine Cook and I have talked with Eran Hammer-Lahav
(editor of the core OAuth spec) about our next steps and it seems that
the first order of business is deciding whether we need one core spec
(basically <http://tools.ietf.org/html/draft-hammer-oauth> with updates)
or two, which would be:

1. The format and protocol for authentication requests as in Section 3
of draft-hammer-oauth

2. The authorization workflow (or workflows) as in Section 4 of
draft-hammer-oauth

We can split the spec into two pieces at any time, but it might
facilitate issue tracking and spec writing to make that decision now.

Thanks!

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Richard Barnes <[email-masked]>
Date: Fri, 29 May 2009 17:08:16 -0400

Hey Peter,

Thanks for the welcome note.  It reminded me that I have some comments 
on draft-hammer-oauth that I need to send in...

With regard to the question of one or two specs, my preference would be 
to have two specs, roughly along the lines you propose:
1. A generic framework for setting up authorization relationships, and
2. An implementation of that framework in HTTP

--Richard

Peter Saint-Andre wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAkogRXoACgkQNL8k5A2w/vwtfACgguTJcjbXjG1SVGUiFU0psDAq
> i8sAoIpIf/0pWVtpt9yHErXeJnM6/g+d
> =pZYY
> -----END PGP SIGNATURE-----
> _______________________________________________
> oauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 29 May 2009 23:28:45 +0100

Hi Peter,

Peter Saint-Andre wrote:
 [...]

>2. The authorization workflow (or workflows) as in Section 4 of
(In my capacity as an individual contributor) I agree it would be better 
to split the documents.

---

From: Hubert Le Van Gong <[email-masked]>
Date: Sat, 30 May 2009 13:54:02 +0200

+1 on splitting the spec into 2 documents.
Also since we did have consensus that the 2-legged scenario (browser-less?) is
to be considered, it would fit nicely into the doc #2, wouldn't it?

Hubert