Subject: Re: [Txauth] Txauth Digest, Vol 8, Issue 17

From: Fabien Imbault <[email-masked]>
Date: Wed, 22 Apr 2020 15:22:10 +0200

+1 transactional (without strong opinions, I would do with something
else/better, but so far I haven't seen one).

"txauth" seems a good enough proposal to me (distinctive & not used
elsewhere & we still know it's related to auth).

Cheers.

---------- Forwarded message ----------
> From: Mike Varley <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Cc:
> Bcc:
> Date: Wed, 22 Apr 2020 12:55:28 +0000
> Subject: Re: [Txauth] alignment on Justin's use of "transactional"
> adjective
>
> +1 to “transactional”
>
> Although I’m not strongly tied to the adjective, I haven’t seen a
> suggestion that more accurately captures the intent of the protocol, which
> to my mind can be summarized as:
>
> There is a pre-flight setup transaction required by clients to
> authorization servers before the OAuth request/response (transaction)
> process can begin to ensure that the following authorization (transaction)
> elements include but are not limited to:
>
>    1. The client is authorized to even attempt the end-user
>    authentication/authorization.
>    2. The client and authorization server have a clear understanding each
>    other’s user engagement capabilities and requirements.
>
> Further, clients and authorization servers are not limited to the same
> static relationship for all authorization transactions.
>
>
>
> Thanks,
>
>
>
> MV
>
>
>
> *From: *Txauth <[email-masked]> on behalf of George Fletcher
> <gffletch=[email-masked]>
> *Organization: *AOL LLC
> *Date: *Wednesday, April 22, 2020 at 8:19 AM
> *To: *Yaron Sheffer <[email-masked]>, Mike Jones <Michael.Jones=
> [email-masked]>, Dick Hardt <[email-masked]>, "
> [email-masked]" <[email-masked]>
> *Subject: *Re: [Txauth] alignment on Justin's use of "transactional"
> adjective
>
>
>
> Generally I'm -1 to "transactional" (though I fully admit I'm biased
> because I have an idea I'm calling "Transaction Tokens" [dealing with
> authorizing a single transaction within a micro-services like architecture]
> :)
>
> I'm definitely against YAAP; largely for the reasons Yaron mentions.
>
> I'm a bit sad that TRADE is not a option because that was my preferred
> option.
>
> For XYZ/XAuth the authorization has a bit of shared component. It's kind
> of a negotiation between the client, the authorization server and the
> resource owner. This is in contrast to many centralized authorization
> models where authorization is granted based on the identity of the
> requestor.
>
> I'm really bad at naming but I'll throw this out there "Client Initiated
> Authorization" :)
>
> On 4/22/20 7:58 AM, Yaron Sheffer wrote:
>
> I am mostly in the Don’t Care camp on this. However:
>
>
>
>  “trade” is the name of a concluded working group, so it’s not an option.
>
> I personally don’t like the “yet another” prefix. To me it is belittling, without adding any useful semantics. It may have been fun when YACC came about (1970 or so), but IMHO not since.
>
>
>
> Thanks,
>
>
>
>                 Yaron
>
>
>
>
>
> From: Txauth <[email-masked]> <[email-masked]> on behalf of Mike Jones <Michael.Jones=[email-masked]> <Michael.Jones=[email-masked]>
>
> Date: Wednesday, April 22, 2020 at 04:20
>
> To: Dick Hardt <[email-masked]> <[email-masked]>, "[email-masked]" <[email-masked]> <[email-masked]> <[email-masked]>
>
> Subject: Re: [Txauth] alignment on Justin's use of "transactional" adjective
>
>
>
>
>
> -1 to “transactional”
>
>
>
>
>
> I and others have proposed many more accurate adjectives including:
>
> Disaggregated
>
> Componentized
>
> Build-Your-Own
>
> Do-It-Yourself
>
> Refactored
>
> Dismembered
>
> Yet Another
>
> Alternative
>
> Reimagined
>
> Back-end Based
>
>
>
> Let’s use one of them or find another one.
>
>
>
>
>
> FYI, my current favorite name is YAAP – Yet Another Authorization Protocol.
>
>
>
>
>
>                                                           -- Mike
>
>
>
>
>
> From: Txauth <[email-masked]> <[email-masked]> On Behalf Of Dick Hardt
>
> Sent: Tuesday, April 21, 2020 6:13 PM
>
> To: [email-masked]
>
> Subject: [Txauth] alignment on Justin's use of "transactional" adjective
>
>
>
>
>
> With the recent threads on the name, I'm going to make a push to get consensus. While there are many of you that don't care, there are also many that do care (myself included)
>
>
>
>
>
> There have been a number of people (including myself) concerned with the protocol being called a transaction, there may be others (besides Justin) that are aligned with Justin's definition that have not felt a need to say anything.
>
>
>
>
>
> So let's get some feedback:
>
>
>
>
>
> Transactional Authorization. It’s an authorization that has aspects and components and artifacts of a transaction.
>
>
>
>
>
> If you are aligned using "transactional", please respond with a +1
>
>
>
>
>
> If you are not aligned, please respond with a -1
>
>
>
>
>
> If you don't care, don't bother responding. :)
>
>
>
> -- Txauth mailing list [email-masked] https://www.ietf.org/mailman/listinfo/txauth
>
>
>
>
>
>
>
>
>
> This email and any attachments are for the sole use of the intended
> recipients and may be privileged, confidential or otherwise exempt from
> disclosure under law. Any distribution, printing or other use by anyone
> other than the intended recipient is prohibited. If you are not an intended
> recipient, please contact the sender immediately, and permanently delete
> this email and its attachments.
> Txauth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Tom Carter <[email-masked]>
Date: Wed, 22 Apr 2020 13:30:50 +0000

+1 transactional

I’m also a big fan of txauth as general name, but if the ‘transactional’ part is an issue, could Tx be backronymed? Something like:

Trust eXchange Auth or Ticket eXchange Auth?

Cheers

From: Txauth <[email-masked]> On Behalf Of Fabien Imbault
Sent: 22 April 2020 14:22
To: [email-masked]
Subject: Re: [Txauth] Txauth Digest, Vol 8, Issue 17

+1 transactional (without strong opinions, I would do with something else/better, but so far I haven't seen one).

"txauth" seems a good enough proposal to me (distinctive & not used elsewhere & we still know it's related to auth).

Cheers.

---------- Forwarded message ----------
From: Mike Varley <[email-masked]<mailto:[email-masked]>>
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc:
Bcc:
Date: Wed, 22 Apr 2020 12:55:28 +0000
Subject: Re: [Txauth] alignment on Justin's use of "transactional" adjective
+1 to “transactional”
Although I’m not strongly tied to the adjective, I haven’t seen a suggestion that more accurately captures the intent of the protocol, which to my mind can be summarized as:
There is a pre-flight setup transaction required by clients to authorization servers before the OAuth request/response (transaction) process can begin to ensure that the following authorization (transaction) elements include but are not limited to:

  1.  The client is authorized to even attempt the end-user authentication/authorization.
  2.  The client and authorization server have a clear understanding each other’s user engagement capabilities and requirements.
Further, clients and authorization servers are not limited to the same static relationship for all authorization transactions.

Thanks,

MV

From: Txauth <[email-masked]<mailto:[email-masked]>> on behalf of George Fletcher <gffletch=[email-masked]<mailto:[email-masked]>>
Organization: AOL LLC
Date: Wednesday, April 22, 2020 at 8:19 AM
To: Yaron Sheffer <[email-masked]<mailto:[email-masked]>>, Mike Jones <Michael.Jones=[email-masked]<mailto:[email-masked]>>, Dick Hardt <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Txauth] alignment on Justin's use of "transactional" adjective

Generally I'm -1 to "transactional" (though I fully admit I'm biased because I have an idea I'm calling "Transaction Tokens" [dealing with authorizing a single transaction within a micro-services like architecture] :)

I'm a bit sad that TRADE is not a option because that was my preferred option.

For XYZ/XAuth the authorization has a bit of shared component. It's kind of a negotiation between the client, the authorization server and the resource owner. This is in contrast to many centralized authorization models where authorization is granted based on the identity of the requestor.

I'm really bad at naming but I'll throw this out there "Client Initiated Authorization" :)
On 4/22/20 7:58 AM, Yaron Sheffer wrote:

Thanks,

                Yaron

From: Txauth <[email-masked]><mailto:[email-masked]> on behalf of Mike Jones <Michael.Jones=[email-masked]><mailto:Michael.Jones=[email-masked]>

To: Dick Hardt <[email-masked]><mailto:[email-masked]>, "[email-masked]"<mailto:[email-masked]> <[email-masked]><mailto:[email-masked]>

-1 to “transactional”

Disaggregated

Componentized

Build-Your-Own

Do-It-Yourself

Refactored

Dismembered

Yet Another

Alternative

Reimagined

Back-end Based

                                                          -- Mike

From: Txauth <[email-masked]><mailto:[email-masked]> On Behalf Of Dick Hardt

To: [email-masked]<mailto:[email-masked]>

-- Txauth mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/txauth<https://www..ietf.org/mailman/listinfo/txauth>

This email and any attachments are for the sole use of the intended recipients and may be privileged, confidential or otherwise exempt from disclosure under law. Any distribution, printing or other use by anyone other than the intended recipient is prohibited. If you are not an intended recipient, please contact the sender immediately, and permanently delete this email and its attachments.
Txauth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/txauth