Subject: [OAUTH-WG] Meeting Minutes

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Jul 2015 16:18:30 +0200

Here are the notes from our meeting yesterday:
https://www.ietf.org/proceedings/93/minutes/minutes-93-oauth

Thanks to Erik for taking notes.

Please let me know if something is missing or incorrect within the next
2 weeks.

Ciao
Hannes

---

From: Mike Jones <[email-masked]>
Date: Sat, 25 Jul 2015 05:07:31 +0000

Good notes.  Please apply the following fixes to them...

To the list of new OAuth RFCs since the last meeting please also add:
	draft-ietf-oauth-json-web-token
	draft-ietf-oauth-saml2-bearer
	draft-ietf-oauth-jwt-bearer

Please change:
	Mike: If the access_token is used, then we must add to spec that it's there for historic reasons and say that it's actually not always the same token.
to:
	Mike: If the access_token is used, then we must add to spec that it's there for historic reasons and say that it's actually not always an access token.

Please change:
	Consensus: For use of existing params defined in OAuth.
to:
	Consensus: For use of existing params defined in OAuth, while allowing some to be optional when not needed.

Please change:
	Mike: Microsoft oauth2 server have a 'resource' param to indicate the audience.
to:
	Mike: Microsoft oauth2 server has a 'resource' param to indicate the resource that the access token will be used to access.

whitely used -> widely used

We need to go on with out lives -> We need to go on with our lives

ready to a shepherd write-up -> ready for a shepherd write-up

Finally, I would add a note saying:
	Some additional drafts are planned, including draft-jones-amr-values and draft-ietf-oauth-discovery

				Thanks
				-- Mike

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Thursday, July 23, 2015 7:19 AM
To: [email-masked]
Subject: [OAUTH-WG] Meeting Minutes

Here are the notes from our meeting yesterday:
https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fwww.ietf.org%2fproceedings%2f93%2fminutes%2fminutes-93-oauth&data=01%7c01%7cMichael.Jones%40microsoft.com%7ccb085108ecb0454b33c008d293699b85%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=5GiVy2SivZk6GWeoXtabbQG1q3r1%2bL%2fnM4o2BmH5Kv8%3d

Ciao
Hannes

---

From: Justin Richer <[email-masked]>
Date: Sat, 25 Jul 2015 09:14:34 +0200

> Consensus: For use of existing params defined in OAuth, while allowing some to be optional when not needed.

That was not the consensus as I understood it in the room. The consensus was the first portion, as originally noted. The second portion was Mike’s requested amendment, and it (and other aspects like the value of token_type) were brought up as details that the editors would work on and come back to the list.

 — Justin

> On Jul 25, 2015, at 7:07 AM, Mike Jones <[email-masked]> wrote:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Campbell <[email-masked]>
Date: Sat, 25 Jul 2015 14:17:06 +0200

My sense of the consensus in the room is as Justin describes it.

On Sat, Jul 25, 2015 at 9:14 AM, Justin Richer <[email-masked]> wrote:

> That was not the consensus as I understood it in the room. The consensus
> was the first portion, as originally noted. The second portion was Mike’s
> requested amendment, and it (and other aspects like the value of
> token_type) were brought up as details that the editors would work on and
> come back to the list.
>
>  — Justin
>
>
> >       Mike: If the access_token is used, then we must add to spec that
> it's there for historic reasons and say that it's actually not always the
> same token.
> > to:
> >       Mike: If the access_token is used, then we must add to spec that
> it's there for historic reasons and say that it's actually not always an
> access token.
> >
> > Please change:
> >       Consensus: For use of existing params defined in OAuth, while
> allowing some to be optional when not needed.
> >
> > Please change:
> >       Mike: Microsoft oauth2 server has a 'resource' param to indicate
> the resource that the access token will be used to access.
> >
> >       Some additional drafts are planned, including
> draft-jones-amr-values and draft-ietf-oauth-discovery
> >
> >                               Thanks
> >                               -- Mike
> >