Subject: Re: [OAUTH-WG] Benoit Claise's Discuss on draft-ietf-oauth-saml2-bearer-21: (with DISCUSS and COMMENT)

From: Mike Jones <[email-masked]>
Date: Mon, 13 Oct 2014 14:13:31 +0000

Thanks for your review Benoit.  I'm adding the working group to the thread so they're aware of your comments.  Replies inline below...

> -----Original Message-----
> From: Benoit Claise [mailto:[email-masked]]
> Sent: Monday, October 13, 2014 6:34 AM
> To: The IESG
> Cc: Tom Taylor; [email-masked]; draft-ietf-oauth-saml2-
> [email-masked]
> Subject: Benoit Claise's Discuss on draft-ietf-oauth-saml2-bearer-21: (with
> DISCUSS and COMMENT)
> 
> Benoit Claise has entered the following ballot position for
> draft-ietf-oauth-saml2-bearer-21: Discuss
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-oauth-saml2-bearer/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> No objection on the document itself, but, as rightly noted by Tom Taylor in the
> OPS-DIR review:
> Process issue: IDnits complains of a normative reference to Informational
> document RFC 6755. This was NOT noted in the Last Call announcement (but
> was noted in the Shepherd writeup). No operational issue identified beyond
> what is already covered by the Interoperability Considerations section.
> 
> As an example, in the case of
> http://datatracker.ietf.org/doc/rfc7317/history/, I had to redo the IETF LC with
> the appropriate statement (based on a DISCUSS from my fellow-AD).
> We should be consistent here.

Barry Leiba had written in response to this "I think the right answer here is to make 6755 an informative reference: it's not needed to understand this document, and is only used as a reference to the document where the namespace was created."  I agree that this resolution would be fine.

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Editorial Nits:
> 
> S2.2: The paragraph before the actual example uses terminology inconsistent
> with RFC 6749:
> 
>  s/authorization code grant/authorization grant/

Per my reply on October 6 to Tom Taylor's review which made the same comment, actually, RFC 6749 uses both terms.  Authorization grant is the generic term.  Authorization Code Grant (defined in Section 4.1 of 6749) is a specific kind of authorization grant.  The text is correct as-is.

				Thanks again,
				-- Mike

---

From: Benoit Claise <[email-masked]>
Date: Mon, 13 Oct 2014 16:18:00 +0200

> Barry Leiba had written in response to this "I think the right answer here is to make 6755 an informative reference: it's not needed to understand this document, and is only used as a reference to…
Fine with me.

Regards, Benoit

---

From: Mike Jones <[email-masked]>
Date: Mon, 13 Oct 2014 14:56:15 +0000

I'm adding the working group to this thread so they're aware of the discussion.  Replies are inline below...

> From: Brian Campbell [mailto:[email-masked]] 
> Sent: Monday, October 13, 2014 7:52 AM
> To: Barry Leiba
> Cc: Benoit Claise; The IESG; [email-masked]; [email-masked]; Tom Taylor
> Subject: Re: Benoit Claise's Discuss on draft-ietf-oauth-saml2-bearer-21: (with DISCUSS and COMMENT)
> 
> Works for me. I've been uncertain about 6755 as informative vs. normative and am more than happy to take Barry's suggestion of making it informative.
> 
> I don't think it's been raised but the same situation with 6755 is in draft-ietf-oauth-jwt-bearer-10 too. I assume a parallel change there is desirable?

Yes, we'd want to make the parallel change.

				-- Mike

> On Mon, Oct 13, 2014 at 7:57 AM, Barry Leiba <[email-masked]> wrote:
> > No objection on the document itself, but, as rightly noted by Tom Taylor
> > in the OPS-DIR review:
> > was noted in the Shepherd writeup). No operational issue identified
> > beyond what is already covered by the Interoperability Considerations
> > section.
> 
> I think the right answer here is to make 6755 an informative
> reference: it's not needed to understand this document, and is only
> used as a reference to the document where the namespace was created.
> 
> Barry

---

From: Mike Jones <[email-masked]>
Date: Mon, 13 Oct 2014 15:13:31 +0000

Re-adding the working group to the thread...

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Barry
> Leiba
> Sent: Monday, October 13, 2014 7:59 AM
> To: Brian Campbell
> > I don't think it's been raised but the same situation with 6755 is in
> > draft-ietf-oauth-jwt-bearer-10 too. I assume a parallel change there
> > is desirable?
> 
> Yes.
> 
> The reason we make documents such as 6755 Informational is that they only
> specify a template and procedure, and have nothing substantive that would
> need to be referred to normatively.
> 
> Barry