Subject: [OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 7 Mar 2017 19:45:30 +0100

Hi all,

here is the write-up:
https://github.com/hannestschofenig/tschofenig-ids/blob/master/shepherd-writeups/Writeup_OAuth_Metadata.txt

I need your feedback on the following issues:

1) Implementation & deployment status of the spec

2) Working group summary (see below)
(Particularly asking Phil whether this is a correct summary.)

3) There are four normative references to non-IETF specifications (see
below). I am wondering whether these are indeed necessary (as normative
references).

4) Any other feedback?

Ciao
Hannes

----

Working Group Summary

   Work on a discovery mechanism for OAuth was planned since a long
   time but it took till late 2015 before a document was submitted
   to the group, which re-used work done in the OpenID Foundation.
   When the WGLC was started in 2016, see
   https://www.ietf.org/mail-archive/web/oauth/current/msg15796.html,
   feedback resulted in significant restructuring of the document.

   Now, almost a year later these concerns have been resolved and
   the document is ready for publication.

----

   [UNICODE]  The Unicode Consortium, "The Unicode Standard",
              <http://www.unicode.org/versions/latest/>.

   [USA15]    Davis, M. and K. Whistler, "Unicode Normalization Forms",
              Unicode Standard Annex 15, June 2015,
              <http://www.unicode.org/reports/tr15/>.

   [OAuth.Post]
              Jones, M. and B. Campbell, "OAuth 2.0 Form Post Response
              Mode", April 2015, <http://openid.net/specs/
              oauth-v2-form-post-response-mode-1_0.html>.

   [OAuth.Responses]
              de Medeiros, B., Ed., Scurtescu, M., Tarjan, P., and M.
              Jones, "OAuth 2.0 Multiple Response Type Encoding
              Practices", February 2014,
<http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html>.

---

From: Mike Jones <[email-masked]>
Date: Tue, 7 Mar 2017 18:58:55 +0000

Replies inline...

-----Original Message-----
From: OAuth [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Tuesday, March 7, 2017 10:46 AM
To: [email-masked]; Phil Hunt <[email-masked]>
Subject: [OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata

Hi all,

here is the write-up:

Microsoft has at least four deployments of the specification.  William Denniss has said that Google uses the specification.  I believe that Ping Identity also uses it.  The specification is used by https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and https://tools.ietf.org/html/draft-ietf-oauth-device-flow-04.

Rather than saying "feedback resulted in significant restructuring of the document" I would say "feedback resulted in focusing the scope of the specification, removing everything except for the authorization server metadata, which remained unchanged".

3) There are four normative references to non-IETF specifications (see below). I am wondering whether these are indeed necessary (as normative references).

I believe that these normative references are all necessary, because they provide information necessary to implement normative portions of the specification.

4) Any other feedback?

Glad this is finishing!

Ciao
Hannes

----

Working Group Summary

----

   [OAuth.Post]

   [OAuth.Responses]
              de Medeiros, B., Ed., Scurtescu, M., Tarjan, P., and M.
              Jones, "OAuth 2.0 Multiple Response Type Encoding
              Practices", February 2014, <http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html>.

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 7 Mar 2017 20:07:03 +0100

Hi Mike

thanks for the quick response and for the wording suggestions.

Regarding the implementations are OpenID Connect implementations
required to implement this functionality?

On 03/07/2017 07:58 PM, Mike Jones wrote:
> Microsoft has at least four deployments of the specification.
> William Denniss has said that Google uses the specification.  I
> believe that Ping Identity also uses it.  The specification is used
> by https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and
> https://tools.ietf.org/html/draft-ietf-oauth-device-flow-04.

Ciao
Hannes

---

From: Mike Jones <[email-masked]>
Date: Tue, 7 Mar 2017 19:15:01 +0000

OpenID Connect implementations are not required to implement this functionality but most do, by virtue of implementing the OpenID Connect metadata specified in https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata.  The OAuth AS Metadata spec is intentionally compatible with this specification.

If you want to include the compatible OpenID Connect examples, there are 34 ASs and 9 clients listed at http://openid.net/certification/ that implement metadata compatible with the AS metadata specification.  See the "Config OP" and "Config RP" columns.

The usage examples I provided in my previous reply were all OAuth examples that did not assume an implementation of OpenID Connect.

				Best wishes,
				-- Mike

-----Original Message-----
From: Hannes Tschofenig [mailto:[email-masked]] 
Sent: Tuesday, March 7, 2017 11:07 AM
To: Mike Jones <[email-masked]>; [email-masked]; Phil Hunt <[email-masked]>
Subject: Re: [OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata

Hi Mike

Regarding the implementations are OpenID Connect implementations required to implement this functionality?

On 03/07/2017 07:58 PM, Mike Jones wrote:
> believe that Ping Identity also uses it.  The specification is used by 
> https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and 

Ciao
Hannes