Subject: [OAUTH-WG] Agenda for IETF#87 Meeting

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 17 Jul 2013 19:37:45 +0200

Hi all, 

it is time to discuss the agenda for the meeting. Here is a strawman proposal. Let us know if you would like to add a topic to the agenda:

- --------

Web Authorization Protocol (OAuth)
==================================

Date: WEDNESDAY, July 31, 2013
Time: 0900-1130 CEST
Room: Tiergarten 1/2

Agenda:

 * Dynamic Client Registration (TBD)
 https://datatracker.ietf.org/doc/draft-ietf-oauth-dyn-reg/
 https://datatracker.ietf.org/doc/draft-hunt-oauth-scim-client-reg/
 
 Goal: Discuss open issues with the WG document and determine
 whether there is interest to adopt the SCIM proposal in the WG.  
 
 * JWT (Mike Jones) -- if necessary
 https://datatracker.ietf.org/doc/draft-ietf-oauth-json-web-token/
 
 Background: This work depends on the progress in the JOSE WG. 
 JOSE made some progress and so the question is whether this 
 document can enter WGLC (soon). What are the open issues? 
 
 * Assertions (Mike Jones) -- if necessary
 https://datatracker.ietf.org/doc/draft-ietf-oauth-assertions/
 https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-bearer/
 https://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer/
 
 Goal: If there are still open issues we should discuss them. 
 Expectation is that the documents are back with the IESG 
 the week before the IETF meeting. 
 
 * Security (Hannes Tschofenig)
 https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-http-mac/ 
 https://datatracker.ietf.org/doc/draft-tschofenig-oauth-audience/
 
 Goal: Get draft-ietf-oauth-v2-http-mac to WGLC. 
 
 * Other items? Rechartering? 

- --------

The latest version of the agenda can be found here: 
http://www.ietf.org/proceedings/87/agenda/agenda-87-oauth

Ciao
Hannes & Derek

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 17 Jul 2013 20:18:55 +0200

Hi,

given that most charter items are (nearly) done, I would highly 
appreciate a discussion about further directions and new topics.

regards,
Torsten.

Am 17.07.2013 19:37, schrieb Hannes Tschofenig:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi all,
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> Comment: GPGTools - http://gpgtools.org
>
> iQEcBAEBCgAGBQJR5tZqAAoJEGhJURNOOiAtMe0IAIjKEHfkLgMW5TJonwuRcVat
> 2cNpc0eIQiiTIj1GnELb6QY3GvxmYyB680UtjIg3eY50bbmMd0v+iW1aSdTWAHLz
> H3eCnMjeVLJnjYPzklNxYcjxvN1F2tC+oBk6o4jJYrGRHizf7nSIt9rbCbFU7T9M
> kl8Z7dASnTWQYPQ21Jr41Wp/fmUhgq2OvMrpSzFEcYp1DIRz94AeZuTac7Q4buKE
> 5PV0XWFq6n2iixnGdHmYI9uMyiSw77k48NGngvdPiefQghG0BqZIgSDvgt+3Thee
> vXWMOCTtxn8/eBe3lvDSiGwi/2PIJztPH06Fc3+szfUnWEdFGdNt8wWk4g6tV9M=
> =rsLq
> -----END PGP SIGNATURE-----
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Phil Hunt <[email-masked]>
Date: Wed, 17 Jul 2013 11:27:22 -0700

I would like to address the issue of client web apps using oauth to authenticate users--something that is not supported by the specs but people are doing anyway.  

OpenId Connect covers the issue but not in a lightweight way for both as and client. 

There seems to be a gap here.

Phil

On 2013-07-17, at 11:18, Torsten Lodderstedt <[email-masked]> wrote:

> Hi,
> 
> given that most charter items are (nearly) done, I would highly appreciate a discussion about further directions and new topics.
> 
> regards,
> Torsten.
>

---

From: Brian Campbell <[email-masked]>
Date: Wed, 17 Jul 2013 13:47:42 -0600

I do not believe there are any open issues on the assertion documents.

The week before the IETF meeting is just a few days away. What needs to
happen to get these back with the IESG?

Note that the JWT assertions draft is dependent on the base JWT document,
which is yet to go to WGLC and in tern depends on the JOSE work. Can it
still proceed or does it need to wait on those dependencies?

I had previously volunteered/requested to present the assertion drafts -
you've got Mike's name listed. I am happy not to do that however, if things
are progressing and there's nothing but status to discuss.

---

From: Mike Jones <[email-masked]>
Date: Wed, 17 Jul 2013 20:26:20 +0000

I support Brian giving this presentation

From: [email-masked] [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Wednesday, July 17, 2013 12:48 PM
To: Hannes Tschofenig
Cc: [email-masked] WG
Subject: Re: [OAUTH-WG] Agenda for IETF#87 Meeting

I do not believe there are any open issues on the assertion documents.
The week before the IETF meeting is just a few days away. What needs to happen to get these back with the IESG?
Note that the JWT assertions draft is dependent on the base JWT document, which is yet to go to WGLC and in tern depends on the JOSE work. Can it still proceed or does it need to wait on those dependencies?
I had previously volunteered/requested to present the assertion drafts - you've got Mike's name listed. I am happy not to do that however, if things are progressing and there's nothing but status to discuss.

On Wed, Jul 17, 2013 at 11:37 AM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:

---

From: Mike Jones <[email-masked]>
Date: Wed, 17 Jul 2013 23:17:05 +0000

Hannes - you wrote "Goal: Get draft-ietf-oauth-v2-http-mac to WGLC".  I believe that there are questions we need to answer as a working group before assuming that that's our goal.  Previously, for instance, we'd discussed that it might be appropriate to replace the MAC draft with work on a holder-of-key token type.  There's also a question of whether it's even needed, given OAuth 1.0 fulfills the same requirements.

Therefore, if the MAC draft is discussed at all, I believe that these are some of the questions we need to address:

(1)  Should the working group recommend the use of OAuth 1.0 when a body signature is wanted, and explicitly stop the work on v2-http-mac?

(2)  (If the answer to (1) is "no")  Should the working group focus its resources on a holder-of-key specification, instead of v2-http-mac?

(3)  (If the answers to (1) and (2) are all "no")  Should we hold the v2-http-mac work until the shape of the holder-of-key work is known, so we know whether v2-http-mac should use the holder-of-key work or not?

(4) (Only if the answers to (1), (2), and (3) are all "no")  What needs to happen for v2-http-mac to progress to WGLC?

				Thanks,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Wednesday, July 17, 2013 10:38 AM
To: [email-masked] WG
Subject: [OAUTH-WG] Agenda for IETF#87 Meeting

Hi all, 

- --------

Agenda:

 Goal: Discuss open issues with the WG document and determine  whether there is interest to adopt the SCIM proposal in the WG.  

 Background: This work depends on the progress in the JOSE WG. 
 JOSE made some progress and so the question is whether this  document can enter WGLC (soon). What are the open issues? 
 
 * Assertions (Mike Jones) -- if necessary  https://datatracker.ietf.org/doc/draft-ietf-oauth-assertions/
 https://datatracker.ietf.org/doc/draft-ietf-oauth-jwt-bearer/
 https://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer/
 
 Goal: If there are still open issues we should discuss them. 
 Expectation is that the documents are back with the IESG  the week before the IETF meeting. 

 

- --------

Ciao
Hannes & Derek

---

From: William Mills <[email-masked]>
Date: Wed, 17 Jul 2013 19:52:40 -0700 (PDT)

I disagree with Mike on several points, and we have had this argument before :)

MAC is not interchangable with 1.0a though they are close.  We might define 1.0a token usage for 2.0 

Holding MAC while we figure out HOK is not my favorite, and if you look at the current MAC draft it has HOK properties.  

The current draft is not ready for last call in my opinion as there are several things to resolve.

Sent from Yahoo! Mail on Android

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Thu, 18 Jul 2013 08:29:14 +0000

Hi Brian,

Regarding progressing the documents here are the next steps:

a)      The shepherd needs to read through the documents. I am the shepherd and I have read through the latest version of the documents yesterday.

b)      I will post a short WGLC to the list to solicit any comments on the most recent version. Will do that in the next few minutes.

c)      I will send a mail to Barry to ask him for a short conference call.

Then, if everything is fine I will produce a new shepherd write-up and send the documents to the IESG.

For the agenda: I am happy if you present any open issues (if there are some). Updated agenda.

Sending all three documents to the IESG is indeed a bit too optimistic (since we have to give folks enough time to read three documents; two of them had not been WGLCed before).

Ciao
Hannes

From: [email-masked] [mailto:[email-masked]] On Behalf Of ext Brian Campbell
Sent: Wednesday, July 17, 2013 9:48 PM
To: Hannes Tschofenig
Cc: [email-masked] WG
Subject: Re: [OAUTH-WG] Agenda for IETF#87 Meeting