Subject: Re: [OAUTH-WG] Last Call review of draft-ietf-oauth-saml2-bearer-21

From: Mike Jones <[email-masked]>
Date: Mon, 6 Oct 2014 07:54:21 +0000

Thanks for your review, Tom.  I've added the working group to this thread so they're aware of your comment.

> -----Original Message-----
> From: Tom Taylor [mailto:[email-masked]]
> Sent: Sunday, September 28, 2014 8:33 PM
> To: [email-masked]; [email-masked]
> Subject: Last Call review of draft-ietf-oauth-saml2-bearer-21
> 
> I have reviewed this document as part of the Operational directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the operational area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
> 
> Tom Taylor
> 
> Summary: Process issue: IDnits complains of a normative reference to
> Informational document RFC 6755. This was NOT noted in the Last Call
> announcement (but was noted in the Shepherd writeup). No operational issue
> identified beyond what is already covered by the Interoperability Considerations
> section.

6755 defines a registry that this specification uses.

> Editorial Nits:
> 
> S2.2: The paragraph before the actual example uses terminology inconsistent
> with RFC 6749:
> 
>   s/authorization code grant/authorization grant/

Actually, RFC 6749 uses both terms.  Authorization grant is the generic term.  Authorization Code Grant (defined in Section 4.1 of 6749) is a specific kind of authorization grant.

				Thanks again,
				-- Mike