Subject: [OAUTH-WG] SWT-qualified names

From: "Paul C. Bryan" <[email-masked]>
Date: Wed, 25 Nov 2009 12:31:39 -0800

To avoid namespace collisions that may occur as Simple Web Token (or its
descendants) evolve or establish further NV-pairs to provide additional
context, I propose that official SWT-scoped names have a short
qualifier, such as a "swt." prefix. Unqualified (non-prefixed)
identifiers would remain private and unofficial. Thoughts?

---

From: Hubert Le Van Gong <[email-masked]>
Date: Wed, 25 Nov 2009 23:57:01 +0100

I'd agree it makes sense, assuming you meant only for the public
attributes names.
That said, it's probably a topic better addressed in the WRAP WG rather than
here since OAuth has always remained token agnostic. Unless it's
changed and I missed that?

Hubert

On Wed, Nov 25, 2009 at 9:31 PM, Paul C. Bryan <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: "Paul C. Bryan" <[email-masked]>
Date: Wed, 25 Nov 2009 14:59:33 -0800

Yes, I mean only public attribute names in the SWT to be
fully-qualified.

The OAuth-WRAP wiki page at http://wiki.oauth.net/OAuth-WRAP indicates
that protocol changes should be discussed on this IETF list.

---

From: Hubert Le Van Gong <[email-masked]>
Date: Thu, 26 Nov 2009 00:09:56 +0100

Then I guess my question is: is it the intention of the SWT authors/proponents
to advocate for the adoption of SWT as "the" official token format for OAuth?

Cheers,
Hubert

---

From: "Paul C. Bryan" <[email-masked]>
Date: Wed, 25 Nov 2009 16:06:58 -0800

I think given the fact SWT is explicitly named in the OAuth-WRAP
specification document, it's likely that SWT will be a commonly-adopted
token format.

---

From: Dick Hardt <[email-masked]>
Date: Thu, 26 Nov 2009 03:18:32 +0000

No, we did not expect SWT to the the official token format for OAuth. It might become that, or it might not. OAuth WRAP was intended to be token agnostic, and the Client should not care.

I have responded to Bryan's question over on the OAuth WRAP WG list on Google as I agree that is where the discussion should be as opposed to here.

-- Dick

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 26 Nov 2009 00:28:53 -0700

Token structure is out of scope for this working group. What is in scope is to make sure proposal such as SWT are enabled by the opaque token supported in the core spec.

Thanks Dick for moving this discussion where it is more productive.

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Dick Hardt
> Sent: Wednesday, November 25, 2009 7:19 PM
> To: Hubert Le Van Gong
> Cc: <[email-masked]>
> Subject: Re: [OAUTH-WG] SWT-qualified names
> 
> No, we did not expect SWT to the the official token format for OAuth. It
> might become that, or it might not. OAuth WRAP was intended to be token
> agnostic, and the Client should not care.
> 
> I have responded to Bryan's question over on the OAuth WRAP WG list on
> Google as I agree that is where the discussion should be as opposed to here.
> 
> -- Dick
> 
> > Then I guess my question is: is it the intention of the SWT
> > authors/proponents to advocate for the adoption of SWT as "the" official
> token format for OAuth?
> >
> >
> > Cheers,
> > Hubert
> >
> >
> >> The OAuth-WRAP wiki page at http://wiki.oauth.net/OAuth-WRAP
> >> indicates that protocol changes should be discussed on this IETF list.
> >>
> >>> That said, it's probably a topic better addressed in the WRAP WG
> >>> rather than here since OAuth has always remained token agnostic.
> >>> Unless it's changed and I missed that?
> >>>
> >>> Hubert
> >>>
> >>>
> >>>> descendants) evolve or establish further NV-pairs to provide
> >>>> additional context, I propose that official SWT-scoped names have a
> >>>> short qualifier, such as a "swt." prefix. Unqualified
> >>>> (non-prefixed) identifiers would remain private and unofficial.
> Thoughts?
> >>>>