Subject: Re: [OAUTH-WG] Breakfast BoF minutes

From: Leif Johansson <[email-masked]>
Date: Thu, 30 Jul 2009 11:14:41 +0200

On Thursday 30 July 2009 08.07.21 Eran Hammer-Lahav wrote:
> Thanks Peter for great and speedy notes.
>
> It is somewhat disappointing that the majority of these items are outside
> the scope of the WG and seem to distract us from making progress on the
> core protocol... I'd like to remind everyone that we are not here to invent
> a new delegation protocol from scratch, and at the same time, OAuth is not
> a codename for 'a popular protocol I can change as I see fit for my own
> needs, and still call it OAuth'.
>

Could you be more specific in your criticism? Which of the suggestions do you
think is out of scope and why (given our charter)? Note that change-control 
for the WG charter ultimately resides with the IESG.

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Fri, 31 Jul 2009 13:05:27 +0200

On Thursday 30 July 2009 19.41.42 Eran Hammer-Lahav wrote:
> First, my issue with scope isn't about technical changes, but about being
> productive. We have made no progress so far and to start branching out at
> this point will make it even worse.

I agree that progress is needed on the core specifications but that doesn't 
preclude thinking and talking about what comes next. 

If you say "Lets not add documents to our charter before we finish what we 
already have on our plate" then I fully agree. 

I don't agree that _discussions_ on the list need to get shut down just 
because they aren't part of the charter - how could we ever decide on new 
charter items otherwise?

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Fri, 31 Jul 2009 13:06:31 +0200

> > 5. Attribute extensions. Could we use OAuth for transporting existing
> > SAML formats?
>
> I would ask for use cases but would rather just keep this discussion out of
> scope for now given the need to focus on getting chartered work done.
>

I sent those in a separate message to the list. 

> > 6. Split off the header signing aspects of OAuth, or at least call that
> > out more clearly in the spec? Someone at the BoF likened this to "DKIM
> > for the Web".
>
> Split off from what?

The idea was to describe header signing independent of oauth (and have
oauth reference that specification) which uses header signing as a way to 
define an http authentication mechanism.

	Cheers Leif