Subject: [Txauth] Tx Auth BOF agenda items

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Oct 2019 08:39:33 -0700

Hey OAuthers

As chair of the Tx BOF coming up in Singapore on Nov 18 @ 5:30-7:30PM Monday
Afternoon, I'm gathering who would be interested in making presentations,
and how much time you would like.

/Dick

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 28 Oct 2019 18:44:43 +0100

Hi Dick, 

Justin asked me to shed some light on the rationale and current status of the work on OAuth Rich & Pushed Authorization Requests. I think I will need 20 min.

best regards,
Torsten. 

> On 28. Oct 2019, at 16:39, Dick Hardt <[email-masked]> wrote:
> 
> Hey OAuthers
> 
> As chair of the Tx BOF coming up in Singapore on Nov 18 @ 5:30-7:30PM	Monday Afternoon, I'm gathering who would be interested in making presentations, and how much time you would like.
> 
> /Dick
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Oct 2019 10:45:52 -0700

Got it. Thanks Torsten!

On Mon, Oct 28, 2019 at 10:44 AM Torsten Lodderstedt <
[email-masked]> wrote:

> Hi Dick,
>
> Justin asked me to shed some light on the rationale and current status of
> the work on OAuth Rich & Pushed Authorization Requests. I think I will need
> 20 min.
>
> best regards,
> Torsten.
>
> > As chair of the Tx BOF coming up in Singapore on Nov 18 @ 5:30-7:30PM
> Monday Afternoon, I'm gathering who would be interested in making
> presentations, and how much time you would like.
> >
> > /Dick

---

From: Kyle Rose <[email-masked]>
Date: Mon, 28 Oct 2019 13:55:28 -0400

> and how much time you would like.

Is this BoF limited to authorization, or would something like end-to-end
authentication of transaction request/response via a less trusted
intermediary (e.g., an API gateway or CDN) for purposes of limiting
transitive trust be in scope? I'm thinking of something akin to
OSCORE-style transactions, but more general (e.g., not specific to
constrained computing environments, not forcing the use of CBOR).

Thanks,
Kyle

---

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Oct 2019 11:02:54 -0700

My understanding was it was transaction authorization.

(it is unfortunate that authorization and authentication both start with
'auth' in english - 'authN' and 'authZ' are preferred to 'auth' IMHO)

---

From: Justin Richer <[email-masked]>
Date: Mon, 28 Oct 2019 16:57:18 -0400

The intended scope is to provide a transactional model for doing authorization delegation, not for authenticating a transaction itself. I can understand the confusion! Naming things is hard. 

 — Justin

> On Oct 28, 2019, at 1:55 PM, Kyle Rose <[email-masked]> wrote:
> 
> On Mon, Oct 28, 2019 at 11:39 AM Dick Hardt <[email-masked] <mailto:[email-masked]>> wrote:
> Hey OAuthers
> 
> Is this BoF limited to authorization, or would something like end-to-end authentication of transaction request/response via a less trusted intermediary (e.g., an API gateway or CDN) for purposes of limiting transitive trust be in scope? I'm thinking of something akin to OSCORE-style transactions, but more general (e.g., not specific to constrained computing environments, not forcing the use of CBOR).
> 
> Thanks,
> Kyle
> -- 
> Txauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth

---

From: Kyle Rose <[email-masked]>
Date: Mon, 28 Oct 2019 17:02:10 -0400

Got it. Thanks. I'll shop around for another venue.

On Mon, Oct 28, 2019, 4:57 PM Justin Richer <[email-masked]> wrote:

> The intended scope is to provide a transactional model for doing
> authorization delegation, not for authenticating a transaction itself. I
> can understand the confusion! Naming things is hard.
>
>  — Justin
>

---

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Oct 2019 14:09:30 -0700

Unclear what I was smoking when I said when the BoF was. It is at
13:30-15:30 per https://datatracker.ietf.org/meeting/106/agenda

Sorry for any confusion.

---

From: Justin Richer <[email-masked]>
Date: Mon, 28 Oct 2019 17:31:55 -0400

I would like to discuss XYZ, to give a quick background and update to the project. I project that to take about 20 min if we dive right into the gritty details. I can also do a level-set for the BoF, like 10min.

 — Justin

> On Oct 28, 2019, at 11:39 AM, Dick Hardt <[email-masked]> wrote:
> 
> Hey OAuthers
>

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 28 Oct 2019 21:35:25 +0000

Justin had requested that I present on some non-authorization use cases for something like XYZ. This shouldn’t take more than 15 minutes.

–
Annabelle Richard Backman
AWS Identity

From: OAuth <[email-masked]> on behalf of Dick Hardt <[email-masked]>
Date: Monday, October 28, 2019 at 8:41 AM
To: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [OAUTH-WG] Tx Auth BOF agenda items

Hey OAuthers

As chair of the Tx BOF coming up in Singapore on Nov 18 @ 5:30-7:30PM
Monday Afternoon, I'm gathering who would be interested in making presentations, and how much time you would like.

/Dick

---

From: Dick Hardt <[email-masked]>
Date: Mon, 28 Oct 2019 14:36:25 -0700

Thanks Justin & Annabelle!

On Mon, Oct 28, 2019 at 2:35 PM Richard Backman, Annabelle <
[email-masked]> wrote:

> Justin had requested that I present on some non-authorization use cases
> for something like XYZ. This shouldn’t take more than 15 minutes.
>
>
>
> –
>
> *From: *OAuth <[email-masked]> on behalf of Dick Hardt <
> [email-masked]>
> *Date: *Monday, October 28, 2019 at 8:41 AM
> *To: *"[email-masked]" <[email-masked]>, "[email-masked]" <
> [email-masked]>
> *Subject: *[OAUTH-WG] Tx Auth BOF agenda items
>
>
>
> Hey OAuthers
>
>
>