Subject: [Txauth] XYZ vs XAuth

From: Mike Varley <[email-masked]>
Date: Tue, 7 Apr 2020 17:27:26 +0000

Hello all, apologies for jumping in late to this conversation.

I would prefer XYZ be the starting draft for this work because it is attempting to define  a common pattern/consistent model to support various use cases, whereas it currently looks like XAuth is accommodating different use cases with different patterns.

One challenge I have seen with OAuth 2.0 is the differences in flows (code, implicit, client credentials, etc...) can make it difficult for developers who thought they were familiar with one flow having to change their designs and thinking for different flows (access_codes returned immediately and how and when that is supposed to happen securely, for example). It would be nice to have a consistent model.

I also want to acknowledge the different but important and beneficial approaches: XAuth is exploring the different use cases explicitly in order to make sure that nothing is missed; and then presumably would align on a consistent model. XAuth is also relying on existing and established JWT standards. XYZ is starting with a model and then exploring how it needs to warp and shift to meet the use case needs, while being less strict on using JWTs to accommodate use cases where JWTs may not always be the best fit. (At least that’s my interpretation of the 2 specs so far).

Ultimately I am confident both approaches will lead to similar end results - however I believe starting with a baseline protocol model that breaks away from some hardened OAuth 2.0 (+) patterns (like JWTs) and then building out and refining is an approach which will lead to a more cohesive spec - and this approach seems more aligned with XYZ.

Thanks - the work on both specs and the charter has been incredible so far and I look forward to this continued momentum!

MV

--------------
From: Txauth <[email-masked]> on behalf of Mike Jones <Michael.Jones=[email-masked]>
Date: Monday, March 23, 2020 at 3:55 PM
To: Dick Hardt <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: Justin Richer <[email-masked]>
Subject: Re: [Txauth] [EXTERNAL] Re: XYZ vs XAuth - 5 differences

I would prefer XAuth as a starting point over XYZ because XAuth is clearly trying to reuse existing identity representations, whereas XYZ is creating a new one.

You can see XAuth’s reuse, for instance, at https://tools.ietf.org/html/draft-hardt-xauth-protocol-06#section-4.6.6.

You can see XYZ’s invention of a new identity schema at https://tools.ietf.org/html/draft-richer-transactional-authz-06#section-2.7.  Yes, it’s similar to some others but not the same, and rather than reusing existing registered claims, it’s creating its own unique set.

                                                       -- Mike

From: Txauth <[email-masked]> On Behalf Of Dick Hardt
Sent: Friday, March 20, 2020 1:18 PM
To: [email-masked]
Cc: Justin Richer <[email-masked]>
Subject: [EXTERNAL] Re: [Txauth] XYZ vs XAuth - 5 differences

ACTION REMINDER

Please weigh in with your preference, your rationale, as well as any pros and cons not described.

Yaron and I were hopeful that we would get more feedback on these topics, as it would help determine if either the XYZ or XAuth documents are roughly aligned with the consensus direction of the group so that we have a starting document.

We will NOT be able to do hums in the BoF ... so we will not be able to use that to judge rough consensus.

/Dick

On Mon, Mar 16, 2020 at 4:04 PM Dick Hardt <mailto:[email-masked]> wrote:
Hello everyone

Justin and I have had some emails back and forth comparing and contrasting XYZ and XAuth. I'm going to post a message for each of the major points, with Justin's rationale and my rationale for our respective design decisions. Feel free to ask clarifying questions in those threads.

Please weigh in with your preference, your rationale, as well as any pros and cons not described.

We would like to get a sense for the group's views on these topics for the virtual BoF in a week.

The latest drafts are:

XYZ: https://tools.ietf.org/html/draft-richer-transactional-authz-06

XAuth: https://tools.ietf.org/html/draft-hardt-xauth-protocol-05

Thanks!

/Dick
ᐧ

This email and any attachments are for the sole use of the intended recipients and may be privileged, confidential or otherwise exempt from disclosure under law. Any distribution, printing or other use by anyone other than the intended recipient is prohibited. If you are not an intended recipient, please contact the sender immediately, and permanently delete this email and its attachments.