Subject: [OAUTH-WG] Working Group Last Call on "Authentication Method Reference Values"

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 18 Jul 2016 16:30:12 +0200

Hi all,

this is a Last Call for comments on the "Authentication Method Reference
Values" specification.

The document can be found here:
https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01

Please have your comments in no later than August 1st.

Ciao
Hannes & Derek

---

From: Blue Teazzers <[email-masked]>
Date: Mon, 18 Jul 2016 20:35:04 +0530

what is this

On Mon, Jul 18, 2016 at 8:00 PM, Hannes Tschofenig <
[email-masked]> wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: William Denniss <[email-masked]>
Date: Thu, 21 Jul 2016 15:03:34 +0200

I'm glad to see this document in working group last call.  The amr values
my team is using in our implementation are included.

I have reviewed the 01 version of this draft, and I believe is ready to
become an RFC.

I have only two minor editorial comments:

1.
Where we reference the claim in Connect (amr draft section 2), we should
also state the specific section, i.e. "is defined by Section 2.0 of the
OpenID Connect Core 1.0 specification".

2.
I found the juxtaposition of the amr claim definition and the values a
little confusing, as the former is re-stating an existing definition while
the latter is new material provided by this spec. I'm glad to see the claim
definition in this draft, as it helps to provide context, but I might
restructure into two sections, as below (green text added/changed).  If
restructured in this way, section 2 would provide the background and
section 3 would provide the new material, making it easier to reference
from other documents.

---

2 <https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01#section-2>.
Authentication Method Reference Claim

   The "amr" (Authentication Methods References) claim is defined by
*section 2.0 of the*
   OpenID Connect Core 1.0 specification [OpenID.Core
<https://tools.ietf.org/html/draft-ietf-oauth-amr-values-01#ref-OpenID.Core>]
as follows:

   amr
      OPTIONAL.  Authentication Methods References.  JSON array of
      strings that are identifiers for authentication methods used in
      the authentication.  For instance, values might indicate that both
      password and OTP authentication methods were used.  The definition
      of particular values to be used in the "amr" Claim is beyond the
      scope of this specification.  Parties using this claim will need
      to agree upon the meanings of the values used, which may be
      context-specific.  The "amr" value is an array of case sensitive
      strings.
*   O**penID Connect does not specify any particular
   Authentication Method Reference values to be used in the "amr" claim.*

*   This specification establishes a registry for these values and
defines a starting list.*

   3.  Authentication Method Reference Values

   The following is a list of Authentication Method Reference values
   defined by this specification:

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Wed, 27 Jul 2016 18:14:06 +0300

> Please have your comments in no later than August 1st.
Thanks Hannes.

Do we have an "amr" value for x.509 certificate based authentication?

-- 
Vladimir Dzhuvinov