Subject: [OAUTH-WG] Reques to drop section 3

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 1 Apr 2011 02:14:03 -0700

There was (still is) a long heated debate at the WG meeting today about client authentication and the dropped client assertion credentials section. I want to repeat my past view (and this time post it as an open issue), that this entire section makes no sense in this document. OAuth should not be defining hackish HTTP authentication schemes, especially ones not using the RFC2617 framework.

Someone can easily register the client_password parameter as an extension (it's a nasty hack but I won't stand in its way), as well as any other poorly design client authentication scheme using form-encoded parameters to authentication an HTTP request...

So - I want to see section 3 turned into a brief discussion about client authentication which gives HTTP Basic auth as an example and nothing else. Client authentication is already 95% out of scope.

EHL

---

From: Anthony Nadalin <[email-masked]>
Date: Fri, 1 Apr 2011 12:10:31 +0000

This section makes sense as it does setup for the identification and authentication of the client, so I do believe that it makes sense in the document.  Thomas undertook the task to revive the Client Credentials section from previous draft that will include normative text, which when asked the room showed interest, I believe he indicated 3 weeks to do this.

I assume you are objecting to not using just HTTP authentication? There are scenarios where we need SAML and other technology so only allowing HTTP authentication is too restrictive and to allow the profiling for interoperability of these technologies we need an extension point here.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer-Lahav
Sent: Friday, April 01, 2011 2:14 AM
To: OAuth WG
Subject: [OAUTH-WG] Reques to drop section 3

EHL

---

From: "Richer, Justin P." <[email-masked]>
Date: Fri, 1 Apr 2011 08:18:48 -0400

-1 once again

I want to keep the client password mechanism in core as it reflects the way that most (nearly all in my personal experience) client implementations pass their auth parameters today. I do think that the assertion credentials could live fine in a simple extension, though, with the same arguments as the assertion grant type.

 -- Justin
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Eran Hammer-Lahav [[email-masked]]
Sent: Friday, April 01, 2011 5:14 AM
To: OAuth WG
Subject: [OAUTH-WG] Reques to drop section 3

Someone can easily register the client_password parameter as an extension (it’s a nasty hack but I won’t stand in its way), as well as any other poorly design client authentication scheme using form-encoded parameters to authentication an HTTP request…

So – I want to see section 3 turned into a brief discussion about client authentication which gives HTTP Basic auth as an example and nothing else. Client authentication is already 95% out of scope.

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 1 Apr 2011 08:17:39 -0700

Withdrawn. I just don't care enough to waste any more time on this. I'll wait for the revised text assigned at the meeting and will integrate at the direction of the chairs.

EHL

On Apr 1, 2011, at 2:14, "Eran Hammer-Lahav" <[email-masked]<mailto:[email-masked]>> wrote:

EHL
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: "William J. Mills" <[email-masked]>
Date: Fri, 1 Apr 2011 10:21:51 -0700 (PDT)

I agree with Justin.

________________________________
From: "Richer, Justin P." <[email-masked]>
To: Eran Hammer-Lahav <[email-masked]>; OAuth WG <[email-masked]>
Sent: Friday, April 1, 2011 5:18 AM
Subject: Re: [OAUTH-WG] Reques to drop section 3

-1 once again

-- Justin

EHL
[email-masked]