Subject: [OAUTH-WG] [[email-masked]] New Version Notification for draft-yu-oauth-token-translation-01.txt

From: Tom Yu <[email-masked]>
Date: Sun, 30 Nov 2014 21:01:17 -0500

Added more technical details and examples.

Subject: New Version Notification for draft-yu-oauth-token-translation-01.txt
From: <[email-masked]>
To: Tom Yu <[email-masked]>, Tom Yu <[email-masked]>
Date: Sun, 30 Nov 2014 17:54:27 -0800

A new version of I-D, draft-yu-oauth-token-translation-01.txt
has been successfully submitted by Tom Yu and posted to the
IETF repository.

Name:		draft-yu-oauth-token-translation
Revision:	01
Title:		A Kerberos Token Translation Service for OAuth
Document date:	2014-11-30
Group:		Individual Submission
Pages:		6
URL:            http://www.ietf.org/internet-drafts/draft-yu-oauth-token-translation-01.txt
Status:         https://datatracker.ietf.org/doc/draft-yu-oauth-token-translation/
Htmlized:       http://tools.ietf.org/html/draft-yu-oauth-token-translation-01
Diff:           http://www.ietf.org/rfcdiff?url2=draft-yu-oauth-token-translation-01

Abstract:
   This document describes a Token Translation Service that allows a
   site to use an existing Kerberos infrastructure to provide
   authentication in an OAuth 2.0 web service environment.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Justin Richer <[email-masked]>
Date: Sun, 30 Nov 2014 21:15:21 -0500

Tom,

I think this is interesting and important work as it could help more directly bridge the gap between Kerberos deployments (more common in enterprise/LAN environments) and the OAuth/web/mobile world. 

When you get down to it, there are really two things going on here: mapping Kerberos ticket claims to JWT claims (and vice versa), and the act of actually translating a ticket into an OAuth token. Perhaps these should be separated more cleanly? I can very easily picture a service that takes in Kerberos tickets and spits out unstructured tokens (or at least tokens without the same claims baked in). This could be specified as an extension of the OAuth Assertions framework, mirroring the JWT and SAML assertions, and could pretty easily be picked up as a WG document if people wanted it. 

In addition to that (but ultimately separate from it, whether it’s in the same document or not), a mechanism for expressing the set of information that’s inside of the Kerberos ticket using the JOSE family of specs still makes sense to have. Much of what’s in JWT’s claim set was influenced by SAML and (to a lesser extent) X.509, so it seems useful to have a similar Kerberos-to-JWT translation process, especially since Kerberos has a few fields that aren’t covered by the current JWT claim set and could be found useful by applications. Better to line up with an existing protocol in this case, in my opinion.

 — Justin

On Nov 30, 2014, at 9:01 PM, Tom Yu <[email-masked]> wrote:

> <New Version Notification for draft-yu-oauth-token-translation-01_txt.eml>_______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth