Subject: Re: [OAUTH-WG] Call for agenda items

From: Dick Hardt <[email-masked]>
Date: Tue, 17 Apr 2018 08:40:20 -0700

I'd like to coordinate a side meeting with Nat, Brian, myself and other
interested parties in Montreal to discuss Distributed OAuth.

If we have two meetings, I'd like a timeslot in the second to summarize the
side meeting and discuss next steps (if any).

Separately, I'd like a time slot for an update on Reciprocal OAuth.

On Wed, Mar 7, 2018 at 5:52 PM, n-sakimura <[email-masked]> wrote:

> No, not really. I was thinking of more informal thing. The session is
> supposed to be Wednesday afternoon, so I was thinking that it might be a
> good idea to do a bit of recap among contributors to draw up a battle plan
> towards IETF 102.
>
>
>
> Nat
>
>
>
> *From:* Rifaat Shekh-Yusef [mailto:[email-masked]]
> *Sent:* Wednesday, March 07, 2018 9:22 PM
> *To:* n-sakimura <[email-masked]>
> *Cc:* Brian Campbell <[email-masked]>; oauth <[email-masked]>
>
> *Subject:* Re: [OAUTH-WG] Call for agenda items
>
>
>
> Nat,
>
>
>
> Are you asking for an interim meeting?
>
> We could schedule the Distributed OAuth discussion for the Wednesday
> meeting; that will give you guys sometime to discuss these face-to-face in
> London.
>
>
>
> Regards,
>
>  Rifaat
>
>
>
>
>
>
>
> On Wed, Mar 7, 2018 at 2:00 AM, n-sakimura <[email-masked]> wrote:
>
> Then let us do it. We need to put all the proposals on the table and
> strategize the design.
>
> Perhaps we need a side meeting as well.
>
>
>
> nat
>
>
>
> *From:* OAuth [mailto:[email-masked]] *On Behalf Of *Brian
> Campbell
> *Sent:* Wednesday, March 07, 2018 1:31 AM
> *To:* Rifaat Shekh-Yusef <[email-masked]>
> *Cc:* oauth <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Call for agenda items
>
>
>
> I hadn't previously been planning on it but am happy to do so.
>
>
>
> On Tue, Mar 6, 2018 at 8:22 AM, Rifaat Shekh-Yusef <[email-masked]>
> wrote:
>
> Nat,
>
>
>
> During the interim meeting, 3 drafts mentioned in the context of *Distributed
> OAuth*:
>
>
>
> https://tools.ietf.org/html/draft-sakimura-oauth-meta-08
>
> https://tools.ietf.org/html/draft-campbell-oauth-resource-indicators-02
>
> https://tools.ietf.org/html/draft-tschofenig-oauth-audience-00
>
>
>
>
>
> *Brian, Hannes,*
>
>
>
> Are you planning on presenting your documents?
>
>
>
> Regards,
>
>  Rifaat
>
>
>
>
>
>
>
>
>
>
>
>
>
> On Mon, Mar 5, 2018 at 8:09 PM, Nat Sakimura <[email-masked]> wrote:
>
> I would be interested in hearing that.
>
>
>
> Also, as part of "Distributed OAuth", can we do a bit of re-cap on some of
> the previous drafts on the similar topic as we discussed in the interim?
> i.e., Brian's draft (where is the link now?) and my draft (
> draft-sakimura-oauth-meta
> <https://tools.ietf.org/id/draft-sakimura-oauth-meta-08.txt>)?
>
>
>
> Best,
>
>
>
> Nat
>
>
>
> On Tue, Mar 6, 2018 at 3:30 AM William Denniss <[email-masked]>
> wrote:
>
> Hannes & Rifaat,
>
>
> I would like the opportunity to present on OAuth 2.0 Incremental
> Authorization (draft-wdenniss-oauth-incremental-auth) [an update for
> which will be posted today] and "OAuth 2.0 Device Posture Signals"
> (draft-wdenniss-oauth-device-posture).
>
>
>
> I can also give an update on the status of Device Flow
> (draft-ietf-oauth-device-flow). I expect that to be short now that WGLC
> has concluded and the document has advanced.
>
>
>
> Little late to this thread and I see we already have 2 sessions in the
> draft agenda, but I'd like to add my support to keeping both sessions,
> there's always a lot to discuss and in the past we've been able to use any
> spare time to discuss the security topics of the day.
>
>
>
> Regards,
>
> William
>
>
>
>
>
>
>
> On Tue, Jan 30, 2018 at 4:40 AM Hannes Tschofenig <
> [email-masked]> wrote:
>
> Hi all,
>
>
>
> It is time already to think about the agenda for the next IETF meeting.
> Rifaat and I were wondering whether we need one or two sessions. We would
> like to make the decision based on the topics we will discuss. Below you
> can find a first version of the agenda with a few remarks. Let us know if
> you have comments or suggestions for additional agenda items.
>
>
>
> Ciao
> Hannes & Rifaat
>
>
>
> OAuth Agenda
>
> ------------
>
>
>
> - Welcome and Status Update  (Chairs)
>
>
>
>   * OAuth Security Workshop Report
>
>
>
>   * Documents in IESG processing
>
>      # draft-ietf-oauth-device-flow-07
>
>      # draft-ietf-oauth-discovery-08
>
>      # draft-ietf-oauth-jwsreq-15
>
>      # draft-ietf-oauth-token-exchange-11
>
>
>
>        Remark: Status updates only if needed.
>
>
>
> -  JSON Web Token Best Current Practices
>
>    # draft-ietf-oauth-jwt-bcp-00
>
>
>
>    Remark: We are lacking reviews on this document.
>
>    Most likely we will not get them during the f2f meeting
>
>    but rather by reaching out to individuals ahead of time.
>
>
>
> -  OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access
> Tokens
>
>    # draft-ietf-oauth-mtls-06
>
>
>
>    Remark: Could be completed by the time of the IETF meeting.
>
>
>
> - OAuth Security Topics
>
>   # draft-ietf-oauth-security-topics-04
>
>
>
>   Remark: We could do a consensus call on parts of the document soon.
>
>
>
> - OAuth 2.0 Token Binding
>
>   # draft-ietf-oauth-token-binding-05
>
>
>
>   Remark: Document is moving along but we are lacking implementations.
>
>
>
> - OAuth 2.0 Device Posture Signals
>
>   # draft-wdenniss-oauth-device-posture-01
>
>
>
>   Remark: Interest in the work but we are lacking content (maybe even
>
>   expertise in the group)
>
>
>
> - Reciprocal OAuth
>
>   # draft-hardt-oauth-mutual-02
>
>
>
>   Remark: We had a virtual interim meeting on this topic and there is
>
>   interest in this work and apparently no competing solutions. The plan
>
>   is to run a call for adoption once we are allowed to add a new milestone
>
>   to our charter.
>
>
>
> - Distributed OAuth
>
>   # draft-hardt-oauth-distributed-00
>
>
>
>   Remark: We had a virtual interim meeting on this topic and there is
>
>   interest in this work. Further work on the scope is needed.
>
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
> --
>
> Nat Sakimura
>
> Chairman of the Board, OpenID Foundation
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>
>

---

From: n-sakimura <[email-masked]>
Date: Wed, 18 Apr 2018 05:33:38 +0000

I support the idea. Adding to it, perhaps we can do an ad-hoc before Montreal so that we can come up with a combined draft.

Nat Sakimura
--
PLEASE READ: This e-mail is confidential and intended for the named recipient only. If you are not an intended recipient, please notify the sender and delete this e-mail.

________________________________
差出人: Dick Hardt <[email-masked]>
送信日時: 2018年4月18日 0:40:20
宛先: n-sakimura
CC: Rifaat Shekh-Yusef; oauth
件名: Re: [OAUTH-WG] Call for agenda items

******************************************************************
本メールはフリーメールから届いています。標的型攻撃メールはフリーメ
ールから届くことがありますのでご注意ください。身に覚えのないメール
であれば添付ファイルやURLを開かず、以下に掲載されている手順に従っ
て対応をお願いします。

共有情報>情報セキュリティトピックス>怪しいメールが届いたら
または、
NRI Group Security Portal>情報セキュリティトピックス
>怪しいメールが届いたら
******************************************************************
I'd like to coordinate a side meeting with Nat, Brian, myself and other interested parties in Montreal to discuss Distributed OAuth.

If we have two meetings, I'd like a timeslot in the second to summarize the side meeting and discuss next steps (if any).

On Wed, Mar 7, 2018 at 5:52 PM, n-sakimura <[email-masked]<mailto:[email-masked]>> wrote:

No, not really. I was thinking of more informal thing. The session is supposed to be Wednesday afternoon, so I was thinking that it might be a good idea to do a bit of recap among contributors to draw up a battle plan towards IETF 102.

Nat

From: Rifaat Shekh-Yusef [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Wednesday, March 07, 2018 9:22 PM
To: n-sakimura <[email-masked]<mailto:[email-masked]>>
Cc: Brian Campbell <[email-masked]<mailto:[email-masked]>>; oauth <[email-masked]<mailto:[email-masked]>>

Subject: Re: [OAUTH-WG] Call for agenda items

Nat,

We could schedule the Distributed OAuth discussion for the Wednesday meeting; that will give you guys sometime to discuss these face-to-face in London.

Regards,

 Rifaat

On Wed, Mar 7, 2018 at 2:00 AM, n-sakimura <[email-masked]<mailto:[email-masked]>> wrote:

Then let us do it. We need to put all the proposals on the table and strategize the design.

nat

From: OAuth [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Brian Campbell
Sent: Wednesday, March 07, 2018 1:31 AM
To: Rifaat Shekh-Yusef <[email-masked]<mailto:[email-masked]>>
Cc: oauth <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Call for agenda items

On Tue, Mar 6, 2018 at 8:22 AM, Rifaat Shekh-Yusef <[email-masked]<mailto:[email-masked]>> wrote:

Nat,

During the interim meeting, 3 drafts mentioned in the context of Distributed OAuth:

Brian, Hannes,

Regards,

 Rifaat

On Mon, Mar 5, 2018 at 8:09 PM, Nat Sakimura <[email-masked]<mailto:[email-masked]>> wrote:

Also, as part of "Distributed OAuth", can we do a bit of re-cap on some of the previous drafts on the similar topic as we discussed in the interim? i.e., Brian's draft (where is the link now?) and my draft (draft-sakimura-oauth-meta<https://tools.ietf.org/id/draft-sakimura-oauth-meta-08.txt>)?

Best,

Nat

On Tue, Mar 6, 2018 at 3:30 AM William Denniss <[email-masked]<mailto:[email-masked]>> wrote:

Hannes & Rifaat,

I would like the opportunity to present on OAuth 2.0 Incremental Authorization (draft-wdenniss-oauth-incremental-auth) [an update for which will be posted today] and "OAuth 2.0 Device Posture Signals" (draft-wdenniss-oauth-device-posture).

I can also give an update on the status of Device Flow (draft-ietf-oauth-device-flow). I expect that to be short now that WGLC has concluded and the document has advanced.

Little late to this thread and I see we already have 2 sessions in the draft agenda, but I'd like to add my support to keeping both sessions, there's always a lot to discuss and in the past we've been able to use any spare time to discuss the security topics of the day.

Regards,

William

On Tue, Jan 30, 2018 at 4:40 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:

Hi all,

It is time already to think about the agenda for the next IETF meeting. Rifaat and I were wondering whether we need one or two sessions. We would like to make the decision based on the topics we will discuss. Below you can find a first version of the agenda with a few remarks. Let us know if you have comments or suggestions for additional agenda items.

Ciao
Hannes & Rifaat

OAuth Agenda

------------

-  OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens

- OAuth Security Topics

  expertise in the group)

- Reciprocal OAuth

  to our charter.

- Distributed OAuth

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

--

Nat Sakimura

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Dick Hardt <[email-masked]>
Date: Wed, 18 Apr 2018 05:37:24 +0000

I’m open to an ad-hoc authors meeting prior.

That may be more productive than a WG meeting.

On Tue, Apr 17, 2018 at 10:33 PM n-sakimura <[email-masked]> wrote:

> I support the idea. Adding to it, perhaps we can do an ad-hoc before
> Montreal so that we can come up with a combined draft.
>
>
> Nat Sakimura
>
> --
>
> PLEASE READ: This e-mail is confidential and intended for the named
> recipient only. If you are not an intended recipient, please notify the
> sender and delete this e-mail.
>
>
>
>
> ------------------------------
> *差出人:* Dick Hardt <[email-masked]>
> *送信日時:* 2018年4月18日 0:40:20
> *宛先:* n-sakimura
> *CC:* Rifaat Shekh-Yusef; oauth
> *件名:* Re: [OAUTH-WG] Call for agenda items
>
> If we have two meetings, I'd like a timeslot in the second to summarize
> the side meeting and discuss next steps (if any).
>
> Authorization (draft-wdenniss-oauth-incremental-auth) [an update for which
> will be posted today] and "OAuth 2.0 Device Posture Signals"
> (draft-ietf-oauth-device-flow). I expect that to be short now that WGLC has
> concluded and the document has advanced.
>
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 18 Apr 2018 10:59:15 +0000

Hey guys,

I am trying to find out what you are planning here.

Are you talking about scheduling a side meeting at the next IETF meeting or a f2f meeting somewhere else?

Rifaat and I had promised to schedule a conference call (virtual interim meeting) about distributed OAuth and we are targeting May. While holding a f2f interim meeting for OAuth is possible we have not discussed this so far.

Ciao
Hannes

From: OAuth [mailto:[email-masked]] On Behalf Of n-sakimura
Sent: 18 April 2018 07:34
To: Dick Hardt; n-sakimura
Cc: oauth
Subject: Re: [OAUTH-WG] Call for agenda items

Nat Sakimura

________________________________
差出人: Dick Hardt <[email-masked]<mailto:[email-masked]>>
送信日時: 2018年4月18日 0:40:20
宛先: n-sakimura
CC: Rifaat Shekh-Yusef; oauth
件名: Re: [OAUTH-WG] Call for agenda items

Nat

Nat,

Regards,

 Rifaat

nat

Nat,

https://tools.ietf.org/html/draft-sakimura-oauth-meta-08<https://tools.ietf..org/html/draft-sakimura-oauth-meta-08>

https://tools.ietf.org/html/draft-campbell-oauth-resource-indicators-02<https://tools.ietf..org/html/draft-campbell-oauth-resource-indicators-02>

https://tools.ietf.org/html/draft-tschofenig-oauth-audience-00<https://tools.ietf..org/html/draft-tschofenig-oauth-audience-00>

Brian, Hannes,

Regards,

 Rifaat

Best,

Nat

Hannes & Rifaat,

Regards,

William

Hi all,

Ciao
Hannes & Rifaat

OAuth Agenda

------------

- OAuth Security Topics

  expertise in the group)

- Reciprocal OAuth

  to our charter.

- Distributed OAuth

--

Nat Sakimura

---

From: Dick Hardt <[email-masked]>
Date: Wed, 18 Apr 2018 14:15:16 +0000

F2F side/author meeting at Montreal
Ad hock author meeting call prior

Unclear to me the value of a WG intern meeting

On Wed, Apr 18, 2018 at 3:59 AM Hannes Tschofenig <[email-masked]>
wrote:

> Rifaat and I had promised to schedule a conference call (virtual interim
> meeting) about distributed OAuth and we are targeting May. While holding a
> f2f interim meeting for OAuth is possible we have not discussed this so
> far.
>
>
>
> Ciao
> Hannes
>
>
>
> *From:* OAuth [mailto:[email-masked]] *On Behalf Of *n-sakimura
> *Sent:* 18 April 2018 07:34
> *To:* Dick Hardt; n-sakimura
> *Cc:* oauth
>
>
> *差出人**:* Dick Hardt <[email-masked]>
> *送信日時**:* 2018年4月18日 0:40:20
> *宛先**:* n-sakimura
> *件名**:* Re: [OAUTH-WG] Call for agenda items
>
>
>
> <https://tools.ietf..org/html/draft-sakimura-oauth-meta-08>
>
> <https://tools.ietf..org/html/draft-campbell-oauth-resource-indicators-02>
>
> <https://tools.ietf..org/html/draft-tschofenig-oauth-audience-00>
>
>
>
>
>
> *Brian, Hannes,*
>
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 18 Apr 2018 14:21:04 +0000

Hi Dick,

The value of a conference call as part of the OAuth working group is that you involve other interested parties to the discussion, and that you do not have to repeat your private conversations later again on the mailing list.
That’s pretty convincing to me ;-)

Ciao
Hannes

From: Dick Hardt [mailto:[email-masked]]
Sent: 18 April 2018 16:15
To: Hannes Tschofenig
Cc: n-sakimura; oauth
Subject: Re: [OAUTH-WG] Call for agenda items

On Wed, Apr 18, 2018 at 3:59 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hey guys,

Ciao
Hannes

From: OAuth [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of n-sakimura
Sent: 18 April 2018 07:34
To: Dick Hardt; n-sakimura
Cc: oauth

Nat Sakimura

Nat

Nat,

Regards,

 Rifaat

nat

Nat,

Brian, Hannes,

Regards,

 Rifaat

Best,

Nat

Hannes & Rifaat,

Regards,

William

Hi all,

Ciao
Hannes & Rifaat

OAuth Agenda

------------

- OAuth Security Topics

  expertise in the group)

- Reciprocal OAuth

  to our charter.

- Distributed OAuth

--

Nat Sakimura

---

From: Dick Hardt <[email-masked]>
Date: Wed, 18 Apr 2018 14:29:08 +0000

The last interm meeting was not very productive. The value I got was that
it would be useful to see if Nat, Brian and I could coalesce.

On Wed, Apr 18, 2018 at 7:21 AM Hannes Tschofenig <[email-masked]>
wrote:

> Hi Dick,
>
>
>
> The value of a conference call as part of the OAuth working group is that
> you involve other interested parties to the discussion, and that you do not
> have to repeat your private conversations later again on the mailing list.
>
> *From:* Dick Hardt [mailto:[email-masked]]
> *Sent:* 18 April 2018 16:15
> *To:* Hannes Tschofenig
> *Cc:* n-sakimura; oauth
>
>
> On Wed, Apr 18, 2018 at 3:59 AM Hannes Tschofenig <

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 18 Apr 2018 19:44:43 +0000

Rifaat and I are also OK with not having to organize a conference call on that topic if you and the group think that no such meeting is necessary.

From: Dick Hardt [mailto:[email-masked]]
Sent: 18 April 2018 16:29
To: Hannes Tschofenig
Cc: n-sakimura; oauth
Subject: Re: [OAUTH-WG] Call for agenda items

The last interm meeting was not very productive. The value I got was that it would be useful to see if Nat, Brian and I could coalesce.

On Wed, Apr 18, 2018 at 7:21 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi Dick,

Ciao
Hannes

From: Dick Hardt [mailto:[email-masked]<mailto:[email-masked]>]
Sent: 18 April 2018 16:15
To: Hannes Tschofenig
Cc: n-sakimura; oauth

Ciao
Hannes

Nat Sakimura

Nat

Nat,

Regards,

 Rifaat

nat

Nat,

Brian, Hannes,

Regards,

 Rifaat

Best,

Nat

Hannes & Rifaat,

Regards,

William

Hi all,

Ciao
Hannes & Rifaat

OAuth Agenda

------------

- OAuth Security Topics

  expertise in the group)

- Reciprocal OAuth

  to our charter.

- Distributed OAuth

--

Nat Sakimura

---

From: Dick Hardt <[email-masked]>
Date: Wed, 18 Apr 2018 12:53:28 -0700

I think it would be useful if we had a draft and we wanted to accelerate
next steps, which may have been what would have happened in the last interm
meeting. But it was not, it was clear there was not consensus on the
problem, so I'm hoping Nat, Brian and myself can get consensus, and then
bring that back to the WG.

I'll take an action item to coordinate with Nat and Brian.

Anyone else interested in participating is also welcome to join!

On Wed, Apr 18, 2018 at 12:44 PM, Hannes Tschofenig <
[email-masked]> wrote:

> Rifaat and I are also OK with not having to organize a conference call on
> that topic if you and the group think that no such meeting is necessary.
>
>
>
> *Sent:* 18 April 2018 16:29
>
> *To:* Hannes Tschofenig
> *Cc:* n-sakimura; oauth
> On Wed, Apr 18, 2018 at 7:21 AM Hannes Tschofenig <