Subject: [OAUTH-WG] Deutsche Telekom launched OAuth 2.0 support

From: Torsten Lodderstedt <[email-masked]>
Date: Fri, 01 Jul 2011 23:19:38 +0200

Hi all,

I would like to announce that we recently launched OAuth 2.0 support in 
our Security Token Service. It will be used in upcoming consumer 
products (e.g. Smartphone apps).

The current implementation supports draft 10 (but is also inline with 
the latest text on native apps). It has the following additional features:
- Issuance of multiple tokens for different services in single 
authorization process (Bulk User Authorization)
- Token revocation 
(http://datatracker.ietf.org/doc/draft-lodderstedt-oauth-revocation/)
- custom grant types for token exchange and SIM card authentication
- Token replacement
- Parameter to explicitely request refresh token for "Resource Owner 
Password Credentials" grant type

regards,
Torsten.

---

From: Igor Faynberg <[email-masked]>
Date: Fri, 01 Jul 2011 17:53:13 -0400

Torsten,

With many thanks for the note, I think it would be great if you 
documented the implementation report in an Informational RFC.  In 
particular, the SIM-based authentication part is of particular interest 
here--we had this discussion on this list recently-- as it naturally 
extends the use of the Internet protocols in the telecom environment.

I also think that such an implementation report would influence 
positively  the OAuth profiling work that is taking  place in ITU-T, OMA 
and other places.

Igor

On 7/1/2011 5:19 PM, Torsten Lodderstedt wrote:
> Hi all,
>
> I would like to announce that we recently launched OAuth 2.0 support 
> in our Security Token Service. It will be used in upcoming consumer 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 02 Jul 2011 03:34:54 +0200

Hi Igor,

if this information is of broader interest - why not. Let's talk about this in Quebec.

regards,
Torsten.

Igor Faynberg <[email-masked]> schrieb:

Torsten,

Igor

On 7/1/2011 5:19 PM, Torsten Lodderstedt wrote:
>_____________________________________________

> https://www.ietf.org/mailman/listinfo/oauth
_____________________________________________

OAuth mailing list
[email-masked]

---

From: Igor Faynberg <[email-masked]>
Date: Thu, 21 Jul 2011 01:39:37 -0400

Friends,

I have intentionally used this thread, on which 1001 messages ago I 
mentioned the OMA and ITU-T work. Since then I got several private 
queries, and I am happy to say that the liaison from OMA has arrived 
(although it has a little glitch, which made me write this otherwise 
redundant message): https://datatracker.ietf.org/liaison/1069/.  The 
glitch is that the liaison description mistakenly says that 1) the 
liaison is sent for information and 2) that there is no deadline in 
response. Section 3 of the document, however, specifies an action for 
the IETF, and it also gives the deadline of the end of August.  This is 
why I wanted to get the immediate attention. (Another little glitch is 
that it was supposed to be copied to the OAuth WG, according to the CC 
list, but this did not happen.)

I must say up fornt  that I do NOT represent OMA and have no authority 
whatsoever to speak for it.  The reason I am involved in this is because 
I have been an ardent supporter of OAuth both in my company and in the 
telecom industry and it has been my vision that  the telecom adapt OAuth 
and combine it with the mobile authentication methods--well I had spoken 
a lot about that on this list and indicated just this interest in the 
early profile query. This should make it clear why I am so enthusiastic 
about OAuth being accepted, and I would like to make sure that we help 
transition this great product of the OAuth WG. OMA is the center for 
standardizing mobile applications infrastructure, and its standards are 
widely used in telecommunictiations industry.

Now,  OMA has appointed an official Liaison Officer whose role is to 
speak for OMA officially. In addition, the response--if produced in 
written form--should by sent to Zhiyuan Hu, who chairs the OMA security 
group.  Handling the liaisons is the IAB job, and the decision on how to 
process this specific one belongs to OAuth chairmen inasmuch as it has 
been directed to OAuth. Having dealt with this procedure before, I 
understand that the communication can emanate directly from them or   
IAB can appoint a liaison to OMA, who will convey future 
communications.  But this is a procedural matter, and I am sure it will 
be well sorted out. (In fact, I remember Barry dealing with the OMA 
liaison in his other group quite expertly.)

The technical lead for this work in OMA is my colleague Jerome Marcon 
(copied here).  Jerome knows OAuth as only developers do -- he has 
implemented it! Jerome has volunteered to answer all questions, and he 
is both the right and the best person for that.

I would like to point out the action of the liaison, which I reproduce 
here verbatim:

"IETF OAuthWG is kindly invited to provide feedback on the points 
highlighted in this letter:

·Availability of the IETF OAuth specifications: especially 
[draft-ietf-oauth-v2] and [draft-ietf-oauth-v2-bearer], and also 
[draft-hammer-oauth-v2-mac-token], [draft-lodderstedt-oauth-revocation] 
and [draft-recordon-oauth-v2-ux].

·Availability of the OAuth Parameters Registry

·IETF intent to specify an OAuth Discovery mechanism

·Considerations that can help implementors decide about the type of 
OAuth access token to deploy.

·For bearer tokens: clarification whether the non-support of percent 
encoding for scope-velement of WWW-Authenticate Response Header Field 
grammar is intentional."

As these are purely technical questions, some of them relating to our 
plans, I just thought it might be a good to present them to the list 
ASAP so that the answers come early.

At this point, I am done with what I thought my job was here. Jerome 
will pick this conversation from now on.

Igor

On 7/1/2011 5:53 PM, Igor Faynberg wrote:
> particular, the SIM-based authentication part is of particular 
> interest here--we had this discussion on this list recently-- as it 
> naturally extends the use of the Internet protocols in the telecom 
> environment.
>
> positively  the OAuth profiling work that is taking  place in ITU-T, 
> OMA and other places.
>
> Igor
>

---

From: SM <[email-masked]>
Date: Thu, 28 Jul 2011 23:41:11 -0700

Hi Igor,
At 10:39 PM 7/20/2011, Igor Faynberg wrote:
>the communication can emanate directly from them or   IAB can 
>appoint a liaison to OMA, who will convey future 
>communications.  But this is a procedural matter, and I am sure it

Murray Kucherawy was appointed as liaison to the Open Mobile Alliance 
in May 2010 (see 
http://www.ietf.org/mail-archive/web/ietf-announce/current/msg07457.html ).

Regards,
-sm

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 29 Jul 2011 08:57:33 -0400

That's correct. Murray is the liaison and he will provide the response of the liaison to the OMA. 
I am the liaison shepherd from the Internet Architecture Board. 

On Jul 29, 2011, at 2:41 AM, SM wrote:

>> the communication can emanate directly from them or   IAB can appoint a liaison to OMA, who will convey future communications.  But this is a procedural matter, and I am sure it
> 
> Murray Kucherawy was appointed as liaison to the Open Mobile Alliance in May 2010 (see http://www.ietf.org/mail-archive/web/ietf-announce/current/msg07457.html ).
> 
> Regards,
> -sm