Subject: [OAUTH-WG] Separate names for authentication and authorization

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 23 Nov 2009 22:45:40 -0700

How do people feel about using OAuth as the name for the different flows to obtain a token, including the new flows defined in WRAP, and calling the authentication part simply the Token Authentication scheme, in line with Basic and Digest?

I think this would be much more in-line with people's expectations of the OAuth "brand".

EHL

---

From: "Paul C. Bryan" <[email-masked]>
Date: Mon, 23 Nov 2009 21:47:11 -0800

+1

On Mon, 2009-11-23 at 22:45 -0700, Eran Hammer-Lahav wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: John Panzer <[email-masked]>
Date: Mon, 23 Nov 2009 22:41:33 -0800

Sounds good ("Token Auth")?
--
John Panzer / Google
[email-masked] / abstractioneer.org / @jpanzer

On Mon, Nov 23, 2009 at 9:47 PM, Paul C. Bryan <[email-masked]> wrote:

> > How do people feel about using OAuth as the name for the different flows
> to obtain a token, including the new flows defined in WRAP, and calling the
> authentication part simply the Token Authentication scheme, in line with
> Basic and Digest?
> >

---

From: Richard Barnes <[email-masked]>
Date: Tue, 24 Nov 2009 08:54:58 -0500

The high-level separation makes sense; I'm fine with reserving OAuth  
for the delegation flow and calling the authentication method  
something else.  (Digression: Could this be helpful in allowing other  
authentication mechanisms into OAuth?)

That said, I'm not sure "Token Auth" is quite accurate (you could just  
as well pass a token over Basic).  The important thing about the  
authentication scheme that OAuth defines is that it provides some of  
the benefit of Digest (e.g., it doesn't reveal secrets) but without  
requiring two RTTs.  Maybe something like "Direct Auth" ("One-Shot"?  
"Simple-Digest"?).

On the other hand, it is just a name.  That which we call OAuth, by  
any other name..

--Richard

On Nov 24, 2009, at 12:45 AM, Eran Hammer-Lahav wrote:

> How do people feel about using OAuth as the name for the different  
> flows to obtain a token, including the new flows defined in WRAP,  
> and calling the authentication part simply the Token Authentication  
> scheme, in line with Basic and Digest?
>

---

From: "Paul C. Bryan" <[email-masked]>
Date: Tue, 24 Nov 2009 06:55:17 -0800

People generally refer to RFC 2617 as (HTTP) "Basic" and "Digest"
authentication methods. Since OAuth is going toward "Token" as the
method type in the Authorization header, it seems to be consistent to
refer to it in similar fashion.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 24 Nov 2009 08:56:08 -0700

<hat type='individual'/>

On 11/23/09 10:45 PM, Eran Hammer-Lahav wrote:
> flows to obtain a token, including the new flows defined in WRAP, and
> calling the authentication part simply the Token Authentication

+1

> I think this would be much more in-line with people's expectations of

Agreed.

/psa

---

From: Richard Barnes <[email-masked]>
Date: Tue, 24 Nov 2009 10:58:46 -0500

Actually, the token that draft-hammer-oauth-07 has for the WWW- 
Authenticate and Authorization headers is "OAuth".  (Were you thinking  
of something else?)  I certainly agree that whatever the token is  
should match our name for the technique, but it's not called "Token"  
right now.

--Richard

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 24 Nov 2009 09:53:45 -0700

The proposal (from a couple months back) was to pick a new scheme name. I have to go back to my notes to see if we reached consensus, but I like Token. It is short, simple, and reflect the idea that you are using a token with specific scope and lifetime instead of regular credentials. How you get that token is left for the other spec (or extensions).

And yes, by having OAuth scoped to the authorization part, it will be easier to bind it with other token transport methods than the HTTP/header.

EHL

> -----Original Message-----
> From: Richard Barnes [mailto:[email-masked]]
> Sent: Tuesday, November 24, 2009 7:59 AM
> To: Paul C. Bryan
> Cc: Eran Hammer-Lahav; OAuth WG ([email-masked])
> Subject: Re: [OAUTH-WG] Separate names for authentication and
> authorization
> 
> Authenticate and Authorization headers is "OAuth".  (Were you thinking of
> something else?)  I certainly agree that whatever the token is should match
> our name for the technique, but it's not called "Token"
> right now.
> 
> --Richard
> 
> 
> 
> 
> >> That said, I'm not sure "Token Auth" is quite accurate (you could
> >> just as well pass a token over Basic).  The important thing about the