Subject: Re: [OAUTH-WG] Revised Charter

From: Barry Leiba <[email-masked]>
Date: Sun, 8 May 2011 18:51:03 -0400

We've had a week and a half for comment, and there've been no
significant suggestions for changes to the charter proposal, so I'm
going to ask the ADs to take the attached charter to the IESG for
approval.

Igor suggested a change here, making it "supports" instead of "consists of":

> OAuth consists of
> * a mechanism for a user to authorize issuance of credentials that
>  a third party can use to access resources on the user's behalf and
> * a mechanism for using the issued credentials to authenticate
>  HTTP requests.

That doesn't strike me as right, but I see why "consists of" might not
read quite right.  I think "encompasses" gets the sense that these two
mechanisms are part of OAuth (a sense that "supports" doesn't give),
while allowing it to be more than that ("consists of" feels like it
says that OAuth is exactly those two things, and nothing more).  So
the attached version uses "encompasses" here.

Igor also suggested adding the use-cases document to the charter.  I
suggest we proceed with the charter as it is, and include the use
cases immediately after, as the first output of subsequent
rechartering.

Barry, as chair

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 09 May 2011 02:06:47 -0400

Barry,

Thanks for considering my proposals.

I am happy with the "encompasses," and I agree that it is better than 
"supports."

 I think I don't understand the reason why the use cases are not going 
to be part of the new charter (or maybe I misunderstood what "subsequent 
rechartering" means).

The idea of establishing a set of OAuth use cases was brought up by 
Peter at the first OAuth meeting.  I liked it very much, because use 
cases make it a clear way to describe the features, which otherwise are 
hard or impossible to discern looking at the protocol spec. Furthermore, 
when a new feature is proposed, starting with a use case sets a good 
discipline for following up with both the design and testing.   (Sure 
enough, almost every thread dedicated to one ore another OAuth feature 
includes a question "What is the use case for this?" in at least one 
posting.)

So, we did not exactly do things top-down in OAuth 2.0, even though I 
personally believe that the present use case spec is ready to be 
published as Informational, but why would we want to repeat this for the 
next version of the protocol?

With thanks,

Igor

Barry Leiba wrote:
> ------------------------------------------------------------------------
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 9 May 2011 11:01:47 +0300

Hi Barry, 

I agree with your points below. 

As said earlier this charter update is a quick short-term update to have the webpage updated with information about what we are currently working on. As requested by Stephen at the last IETF meeting we will recharter again after we shipped the main specifications (core + bearer/MAC specs) to the IESG. 

Ciao
Hannes

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of ext Barry Leiba
> Sent: Monday, May 09, 2011 1:51 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [OAUTH-WG] Revised Charter
>

---

From: David Recordon <[email-masked]>
Date: Mon, 9 May 2011 01:50:59 -0700

Hey Barry, I'm confused. This thread is full of comments. Is there an
updated charter which addresses them?

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 9 May 2011 14:17:21 +0300

On Apr 28, 2011, at 4:01 AM, Eran Hammer-Lahav wrote:

>> Nov 2011    Prepare re-chartering
> 
> I would like this removed.
> 
> I would like to see this WG closed when this list is complete and if there is further work with enough interest, a new working group can be created.

Hi Eran, 

we already today see interest in doing additional work beyond what is on the charter. We could remove the explicit item from the charter but we will definitely call for rechartering after we are done with the currently chartered items. 

Ciao
Hannes

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 9 May 2011 11:19:16 +0000

I think that a re-charter after would be a great idea

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Monday, May 09, 2011 4:17 AM
To: Eran Hammer-Lahav
Cc: [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] Revised Charter

Hi Eran, 

Ciao
Hannes

---

From: Barry Leiba <[email-masked]>
Date: Mon, 9 May 2011 10:29:33 -0400

David says...
> updated charter which addresses them?

Well, your earlier message doesn't suggest any changes, nor does
Dick's.  Thomas's does, but he retracted them after he understood the
purpose of this rechartering (see below).  So there aren't as many
comments in this thread as you think.  I did, however miss Eran's
comments (so sorry!), but I think Hannes picked those up in his
update, posted after mine.

Igor, on the use cases: The point of this rechartering is to focus
tightly on getting the base protocol done Very Soon.  I agree with you
that a use-cases document would be great to publish, and if that's
kept current with any new discussions here it should be easy to pop it
out right away after the next recharter.  But we (and the ADs) don't
want to have any distractions from getting OAuth 2.0 out.

I don't think this will really be an issue.  If "use cases" is about
ready to go, then it will go out very quickly afterward, and all will
be well.

For the ADs, I'm attaching Hannes's updated version of the charter for
you to proceed with.

Barry, as chair

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 09 May 2011 16:45:11 +0100

Thanks folks for your work in updating the charter.

I'll take a peek at this and get back about getting it put
in place in the next few days.

S.

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 9 May 2011 09:30:15 -0700

Sure, there are plenty of things, each with a few people showing interest. But I have yet to see any proposal with enough interest to justify a working group. 5 items, each with 5 people showing interest doesn't make it a 25 people working group. It makes it 5 individual submissions with negligible support.

Keeping this text in the charter implies that we already have consensus for re-chartering. We don't.

EHL

> From: Hannes Tschofenig [mailto:[email-masked]]
> Cc: Hannes Tschofenig; Blaine Cook; [email-masked]; oauth-
> [email-masked]
> > I would like to see this WG closed when this list is complete and if there is
> further work with enough interest, a new working group can be created.
> 
> Hi Eran,
> 
> we already today see interest in doing additional work beyond what is on the
> charter. We could remove the explicit item from the charter but we will
> definitely call for rechartering after we are done with the currently chartered
> items.
> 
> Ciao
> Hannes

---

From: Phil Hunt <[email-masked]>
Date: Mon, 9 May 2011 10:47:03 -0700

There are several things being held back to allow the core specification to complete. For example, I would expect more expanded work on tokens. There is also several items in the status pages (e.g. my chain proposal), revocation etc, that will also need to be discussed.

You did mention the MAC spec should probably be in an another WG. The outcome of this decision will likely impact future re-chartering, since other "token" formats should follow the same path.

Suffice to say a re-chartering will be needed again.

Phil
[email-masked]

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 09 May 2011 15:18:21 -0400

Barry,

I agree. Indeed, after ascertaining that the next rechartering is 
scheduled for October, I personally see no problem with deferring the 
use cases. (I thought that the current rechartering was already 
post-2.0, which  is what had confused me.)

With thanks for thorough follow-ups,

Igor

Barry Leiba wrote:
> ...
> .

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 9 May 2011 12:25:31 -0700

I don't see why we can't just publish this document as an informational RFC now. I sure hope we are not going to accommodate any new use cases...

Also, since this is not a normative document, the WG value here is minimal. I think Igor can move forward with publishing this as an individual submission, but will also be supportive of making it a working group item and quickly moving to final WG LC and off to the IESG.

EHL

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Igor Faynberg
> Sent: Monday, May 09, 2011 12:18 PM
> To: Barry Leiba
> I agree. Indeed, after ascertaining that the next rechartering is scheduled for
> October, I personally see no problem with deferring the use cases. (I thought
> that the current rechartering was already post-2.0, which  is what had
> confused me.)
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 9 May 2011 12:04:58 -0700

A good example is the discussion going on about the http-state working group. The WG finished their work on cleaning the cookie specification. Some people want to continue work on cookies v.next. It is far from clear if the same working group will be re-chartered, or a new working group created, or none.

The problem with re-chartering is that it usually leads to weaker review of the need to form a working group. The test should be whether the items you mentioned would merit the creation of a working group if this one was closed. I highly doubt it.

I want to see this working group reach its end when this charter is fulfilled. At that point, a new working group can be requested to work on other items. The new working group can continue using this list which I assume will remain open.

EHL

> From: Phil Hunt [mailto:[email-masked]]
> Sent: Monday, May 09, 2011 10:47 AM
> To: Eran Hammer-Lahav
> Cc: oauth WG; [email-masked]
> There are several things being held back to allow the core specification to
> complete. For example, I would expect more expanded work on tokens.
> There is also several items in the status pages (e.g. my chain proposal),
> revocation etc, that will also need to be discussed.
> 
> You did mention the MAC spec should probably be in an another WG. The
> outcome of this decision will likely impact future re-chartering, since other
> "token" formats should follow the same path.
> 
> > Sure, there are plenty of things, each with a few people showing interest.
> But I have yet to see any proposal with enough interest to justify a working
> group. 5 items, each with 5 people showing interest doesn't make it a 25
> people working group. It makes it 5 individual submissions with negligible
> support.
> >
> >> we already today see interest in doing additional work beyond what is
> >> on the charter. We could remove the explicit item from the charter
> >> but we will definitely call for rechartering after we are done with
> >> the currently chartered items.
> >>
> >> Ciao
> >> Hannes
> >

---

From: Igor Faynberg <[email-masked]>
Date: Mon, 09 May 2011 15:44:06 -0400

Actually, I am NOT an author of use cases; I am just a proponent  of 
this work.  The decision of whether and when to move  to publishing 
belongs to the authors: George, Torsten, and Zachary.

Of course, if the authors choose to do so,  the draft can go to the RFC 
Editor as an Independent (or AD-sponsored) submission, but I see two 
drawbacks here: 1) This would break the connection of the use cases to 
the protocol work and thus counter their/* *//*raison d'être*/ and 2) 
this may take very, very long. (As a former WG chair and an author of a 
few RFCs, one of which was AD-sponsored and another Independent, I have 
learned all of this the hard way...)

This is why my inclination has been, and still is, toward Eran's second 
option.

Igor

---

From: Barry Leiba <[email-masked]>
Date: Mon, 9 May 2011 22:34:02 -0400

> The problem with re-chartering is that it usually leads to weaker review of
> the need to form a working group.

When it comes time to deal with the charter item of rechartering,
we'll see where the consensus of the working group and the guidance of
the ADs go at that time.  The consensus may be to recharter, or it may
be to close the working group.  Having the item on this charter sets a
time-frame for the decision.  Please don't waste any more time bashing
this one.

Barry, as chair

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 10 May 2011 05:46:39 +0300

> I want to see this working group reach its end when this charter is fulfilled. At that point, a new working group can be requested to work on other items. The new working group can continue using t…

Eran, it is typically that people find their own work most useful and relevant. That's great. However, just because you do not want to do further work (for example because you have moved on to new topics) does not mean that everyone else shouldn't do anything else either. Please keep in mind that other folks have higher expectations regarding OAuth interoperability beyond just having the core specification. 

Ciao
Hannes

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 9 May 2011 22:14:03 -0700

This reply was just uncalled for.

I resent the suggestions that my motives here are based on 'moving on to new topics', implying that if I don't want to continue working on OAuth, no one should.

My views are based solely on what I believe is in the best interest of this protocol and the concern that what is now a simple and useful protocol will turn into a goo of premature, designed-by-committee, anti-web extensions. Most of what I've seen suggested so far falls right into this category. Excuse me if the personal investment I have made in this work (far exceeding anyone else's) makes me protective of it.

EHL

> Sent: Monday, May 09, 2011 7:47 PM
> To: Eran Hammer-Lahav
> Cc: Hannes Tschofenig; Phil Hunt; oauth WG; [email-masked]
> > I want to see this working group reach its end when this charter is fulfilled.
> At that point, a new working group can be requested to work on other items.
> The new working group can continue using this list which I assume will remain
> open.
> 
> 
> Eran, it is typically that people find their own work most useful and relevant.
> That's great. However, just because you do not want to do further work (for
> example because you have moved on to new topics) does not mean that
> everyone else shouldn't do anything else either. Please keep in mind that
> other folks have higher expectations regarding OAuth interoperability
> beyond just having the core specification.
> 
> Ciao
> Hannes