Subject: [OAUTH-WG] Meeting Minutes

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 14 Nov 2014 04:05:29 +0100

Hi all,

here is a draft version of the meeting minutes:
http://www.ietf.org/proceedings/91/minutes/minutes-91-oauth

Thanks to Brian Rosen for taking notes.

Comments are welcome!

Ciao
Hannes & Derek

---

From: Brian Campbell <[email-masked]>
Date: Fri, 14 Nov 2014 07:26:16 -0700

My question was not really about the status of
draft-bradley-oauth-stateless-client-id but rather about
draft-ietf-oauth-dyn-reg-management allowing for the kind of stateless
client id that Bradley described in his draft.

And draft-ietf-oauth-dyn-reg-management still has text that says, 'The
value of the "client_id" MUST NOT change from the initial registration
response.' which makes it incompatible with the concepts described in
draft-bradley-oauth-stateless-client-id.

On Thu, Nov 13, 2014 at 8:05 PM, Hannes Tschofenig <
[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: Mike Jones <[email-masked]>
Date: Fri, 14 Nov 2014 19:43:30 +0000

Please change "jwt-req-request" to "jwt-reg-review", per https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-30#section-10.1.

Other than that, the minutes look good.

				Thanks,
				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Thursday, November 13, 2014 5:05 PM
To: [email-masked]
Subject: [OAUTH-WG] Meeting Minutes

Hi all,

Comments are welcome!

Ciao
Hannes & Derek

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 19 Nov 2014 11:57:21 +0100

Hi Mike, Hi Brian,

I have updated the meeting minutes based on your requests.
Here is the updated version:
http://www.ietf.org/proceedings/91/minutes/minutes-91-oauth

Ciao
Hannes

---

From: Antonio Sanso <[email-masked]>
Date: Tue, 25 Nov 2014 09:44:24 +0000

hi Hannes ,

thanks for sharing the minutes.

about

======
John reported a security problem where a 302 redirect without user interaction causes security problems. 
Do we want to say somthing about this?  Implementation guidance somewhere?

Chairs: Is this written up?

John: Yes, on mailing list.

Justin: This might be a good example for the oauth.net article section because it's implementation advice, not a change to the protocol.
=====

I assume (maybe wrong) this might be about [0].
My question is there any timeline/action plan for this topic?
I am more than happy if I could contribute or try to help out

regards

antonio

[0] http://www.ietf.org/mail-archive/web/oauth/current/msg13367.html

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 25 Nov 2014 15:27:06 +0100

Hi Antonio,

thanks for raising this issue and for pointing to the relevant email
exchange.

Let me figure out the schedule for getting this issue resolved. I
believe we could cover this topic in one of our conference calls (for
which I have to distribute a poll first).

I believe it is important to produce a write-up about this issue; the
question is only what the appropriate format is.

Ciao
Hannes

On 11/25/2014 10:44 AM, Antonio Sanso wrote:
> ====== John reported a security problem where a 302 redirect without
> user interaction causes security problems. Do we want to say somthing
> about this?  Implementation guidance somewhere?
> 
> Justin: This might be a good example for the oauth.net article
> section because it's implementation advice, not a change to the
> protocol. =====
> 
> I assume (maybe wrong) this might be about [0]. My question is there
> any timeline/action plan for this topic? I am more than happy if I
> could contribute or try to help out
> 
> regards
> 
> antonio
> 
>> Ciao Hannes & Derek
>> _______________________________________________ OAuth mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/oauth
>