Subject: [OAUTH-WG] FW: [Fwd: I-D ACTION:draft-vrancken-oauth-redelegation-00.txt]

From: "Zeltsan, Zachary (Zachary)" <[email-masked]>
Date: Thu, 1 Oct 2009 11:24:19 -0500

This is reminder of the draft draft-vrancken-oauth-redelegation-00.txt. The authors of the draft would like to get feedback on the proposed work (otherwise I should assume that there are no objections to accepting the proposal as a work item).

With best regards,

Zachary

> -----Original Message-----
> From: Zeltsan, Zachary (Zachary) 
> Sent: Friday, September 18, 2009 3:54 AM
> To: Peter Saint-Andre
> Cc: [email-masked]; Faynberg, Igor (Igor); Richard Barnes
> Subject: RE: [OAUTH-WG] [Fwd: I-D 
> ACTION:draft-vrancken-oauth-redelegation-00.txt]
> 
> Peter,
> 
> We briefly introduced the draft in the original email, which 
> Richard has mentioned. As Igor has explained, the goal of the 
> draft is to describe a use case for the "four-legged" OAuth. 
> (Richard's and Igor's messages are attached). The term 
> "four-legged" was criticized at the Breakfast BoF, so it is 
> not used (although is mentioned) in the draft. The draft also 
> explains the use of the OAuth for the recursive ("n-legged") 
> delegation.
> 
> Zachary
>  
> 
> > -----Original Message-----
> > From: [email-masked] 
> [mailto:[email-masked]] On Behalf 
> > Of Igor Faynberg
> > Sent: Thursday, September 10, 2009 1:54 PM
> > To: Richard Barnes
> > Cc: [email-masked]
> > Subject: Re: [OAUTH-WG] [Fwd: I-D
> > ACTION:draft-vrancken-oauth-redelegation-00.txt]
> > 
> > Richard,
> > 
> > The authors are traveling now, so I will be happy to chime-in. 
> > (Incidentally, Zachary had sent a notice to this list some time 
> > before.)
> > 
> > In short, this is a follow-up on 1) an interesting 
> discussion on the 
> > list Re:
> > "four-legged" approach; and 2) the bar meeting at the last 
> IETF, which 
> > Zachary attended.
> > 
> > Here, in compliance with what appeared to be the consensus 
> of the bar 
> > meeting, the term of "four-legged" was dropped. The concept 
> has been 
> > described as "recursive delegation." The goal of the draft was to 
> > document it and provide a use case.
> > 
> > With best regards,
> > 
> > Igor
> > 
> > On 9/9/2009 9:34 PM, Richard Barnes wrote:
> > > Think they already did, to first order:
> > > <http://www.ietf.org/mail-archive/web/oauth/current/msg00284.html>
> > > 
> > > 
> > > Peter Saint-Andre wrote:
> > > 
> > >>-----BEGIN PGP SIGNED MESSAGE-----
> > >>Hash: SHA1
> > >>
> > >><hat type='chair'/>
> > >>
> > >>As seen on the [email-masked] list just now. Perhaps the 
> > >>authors would like to provide a friendly introduction to
> > their work? 
> > >>:)
> > >>
> > >>/psa
> > >>
> > >>- -------- Original Message --------
> > >>Subject: I-D ACTION:draft-vrancken-oauth-redelegation-00.txt
> > >>Date: Wed,  9 Sep 2009 09:15:01 -0700 (PDT)
> > >>From: [email-masked]
> > >>Reply-To: [email-masked]
> > >>To: [email-masked]
> > >>
> > >>A New Internet-Draft is available from the on-line 
> Internet-Drafts 
> > >>directories.
> > >>
> > >>
> > >>	Title		: Using OAuth for Recursive Delegation
> > >>	Author(s)	: B. Vrancken, Z. Zeltsan
> > >>	Filename	: draft-vrancken-oauth-redelegation-00.txt
> > >>	Pages		: 11
> > >>	Date		: 2009-9-4
> > >>	
> > >>   This document describes a use case for delegating
> > authorization by a
> > >>   Resource Owner to another user via a Client using the
> > OAuth protocol.
> > >>   OAuth allows Clients to access server resources on behalf of 
> > >> another  party (such as a different Client or an
> > end-user).  This document
> > >>   describes the use of OAuth for delegating one Client's
> > authorization
> > >>   to another Client - a scenario, which is also known as
> > four-legged
> > >>   authorization.
> > >>
> > >>A URL for this Internet-Draft is:
> > >>http://www.ietf.org/internet-drafts/draft-vrancken-oauth-red
> > elegation-
> > >>00.txt
> > >>
> > >>-----BEGIN PGP SIGNATURE-----
> > >>Version: GnuPG v1.4.8 (Darwin)
> > >>Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> > >>
> > >>iEYEARECAAYFAkqn1roACgkQNL8k5A2w/vyW1wCeImOus7lIB1MV4wqQ1cF25mWz
> > >>DZUAnjqmTRH8JX4vKFbkeOEHS1ahVijP
> > >>=rPFC
> > >>-----END PGP SIGNATURE-----
> > >>_______________________________________________
> > >>OAuth mailing list
> > >>[email-masked]
> > >>https://www.ietf.org/mailman/listinfo/oauth
> > >>
> > > 
> > > _______________________________________________
> > > OAuth mailing list
> > > [email-masked]
> > > https://www.ietf.org/mailman/listinfo/oauth
> > 
> > 
> > _______________________________________________
> > OAuth mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/oauth
> > 
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 1 Oct 2009 10:29:18 -0700

I object to making the proposal a work item until we are ready to move the current two drafts to last-call.

EHL

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Zeltsan, Zachary (Zachary)
> Sent: Thursday, October 01, 2009 9:24 AM
> To: [email-masked]
> Cc: Vrancken, Bart Bv (Bart)
> Subject: [OAUTH-WG] FW: [Fwd: I-D ACTION:draft-vrancken-oauth-
> redelegation-00.txt]
> 
> 
> This is reminder of the draft draft-vrancken-oauth-redelegation-00.txt.
> The authors of the draft would like to get feedback on the proposed
> work (otherwise I should assume that there are no objections to
> accepting the proposal as a work item).
> 
> With best regards,
> 
> Zachary
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 01 Oct 2009 11:29:30 -0600

<hat type="chair"/>

On 10/1/09 10:24 AM, Zeltsan, Zachary (Zachary) wrote:
> 
> This is reminder of the draft
> draft-vrancken-oauth-redelegation-00.txt. The authors of the draft
> would like to get feedback on the proposed work (otherwise I should
> assume that there are no objections to accepting the proposal as a
> work item).

Our charter (i.e., our "contract" with the IESG) states:

   After delivering OAuth 1.1, the Working Group may consider
   defining additional functions and/or extensions...

Naturally we can discuss draft-vrancken-oauth-redelegation (and other
specs) on this list.  And I don't think we absolutely must wait until
draft-ietf-oauth-authentication and draft-ietf-oauth-web-delegation are
delivered to the IESG before taking on additional WG items.  However, I
am at least hesitant to take attention away from the core specs (and
draft-hammer-oauth as informational documentation of "OAuth Core 1.0
Revision A" with errata) until we have consensus on the major issues
we've been discussing recently: mandatory signature algorithms, the
appropriate place to communicate client credentials, simplifying request
normalization, token expiration, improved error codes, interaction of
OAuth with HTTP caching, etc.  I also think it would be very helpful for
members of this list to complete reviews of the above-mentioned I-Ds
(perhaps after the document editor has had a chance to incorporate the
results of recent list discussion).

That said, if the group comes to consensus that it would like to accept
draft-vrancken-oauth-redelegation as an official work item of the OAuth
WG, we could proceed with doing so.  If the authors would like the
chairs to issue a consensus call on this matter, please let us know.

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Igor Faynberg <[email-masked]>
Date: Thu, 01 Oct 2009 13:47:02 -0400

I think Peter's advice is very reasonable.  Ultimately the point here is 
to get the discussion going without delaying the schedule for the agreed 
deliverables.  It surely is the WG chairs' prerogative to decide on what 
ought to be done first.

Personally, I don't see any reason to issue a call for consensus before 
the draft has been discussed. I remember the burst of discussions on the 
mailing list before the "bar session," which clearly indicated an 
interest, so I thought we would see more of it after the draft has been 
published.

 I hope that we will get a chance to discuss this in Hiroshima.

Igor

Peter Saint-Andre wrote:
> iEYEARECAAYFAkrE5voACgkQNL8k5A2w/vyuUQCgvmtiKTSsfpp9EoqQE38RYx+y
> tycAn30XJx74n5/7LbX6gEzcTN45zCur
> =+lG6