Subject: Re: [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-01.txt

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 07 Jun 2012 08:40:40 -0600

Hi Bill,

The new key-value syntax seems preferable to me. One small point: did
you mean to reference RFC 2234 for ABNF instead of RFC 5234?

I'll take time to review it more carefully soon.

Peter

On 5/30/12 3:57 PM, William Mills wrote:
> This draft rips out the HTTP style format and in band discovery. 
> Feedback would be very welcome.
> 
> Many thanks to Alexey for helping me get this posted.
> 
> -bill
> 
> 
>     ------------------------------------------------------------------------
>     *From:* "[email-masked]" <[email-masked]>
>     *To:* [email-masked]
>     *Cc:* [email-masked]
>     *Sent:* Wednesday, May 30, 2012 12:02 PM
>     *Subject:* [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-01.txt
> 
> 
>     A New Internet-Draft is available from the on-line Internet-Drafts
>     directories. This draft is a work item of the Common Authentication
>     Technology Next Generation Working Group of the IETF.
> 
>         Title          : A SASL and GSS-API Mechanism for OAuth
>         Author(s)      : William Mills
>                               Tim Showalter
>                               Hannes Tschofenig
>         Filename        : draft-ietf-kitten-sasl-oauth-01.txt
>         Pages          : 21
>         Date            : 2012-05-30
> 
>       OAuth enables a third-party application to obtain limited access to a
>       protected resource, either on behalf of a resource owner by
>       orchestrating an approval interaction, or by allowing the third-party
>       application to obtain access on its own behalf.
> 
>       This document defines how an application client uses OAuth over the
>       Simple Authentication and Security Layer (SASL) or the Generic
>       Security Service Application Program Interface (GSS-API) to access a
>       protected resource at a resource serve.  Thereby, it enables schemes
>       defined within the OAuth framework for non-HTTP-based application
>       protocols.
> 
>       Clients typically store the user's long term credential.  This does,
>       however, lead to significant security vulnerabilities, for example,
>       when such a credential leaks.  A significant benefit of OAuth for
>       usage in those clients is that the password is replaced by a token.
>       Tokens typically provided limited access rights and can be managed
>       and revoked separately from the user's long-term credential
>       (password).
> 
> 
>     A URL for this Internet-Draft is:
>     http://www.ietf.org/internet-drafts/draft-ietf-kitten-sasl-oauth-01.txt
> 
>     Internet-Drafts are also available by anonymous FTP at:
>     ftp://ftp.ietf.org/internet-drafts/
> 
>     This Internet-Draft can be retrieved at:
>     ftp://ftp.ietf.org/internet-drafts/draft-ietf-kitten-sasl-oauth-01.txt
> 
>     The IETF datatracker page for this Internet-Draft is:
>     https://datatracker.ietf.org/doc/draft-ietf-kitten-sasl-oauth/
> 
>     _______________________________________________
>     Kitten mailing list
>     [email-masked] <mailto:[email-masked]>
>     https://www.ietf.org/mailman/listinfo/kitten
> 
> 
> 
> 
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

---

From: William Mills <[email-masked]>
Date: Thu, 7 Jun 2012 08:21:07 -0700 (PDT)

I don't know the differences between the two, but for what I was referencing it's defined in both 2234 and 5234.  Does it matter which one I use?

>________________________________
> From: Peter Saint-Andre <[email-masked]>
>To: William Mills <[email-masked]> 
>Cc: "[email-masked]" <[email-masked]> 
>Sent: Thursday, June 7, 2012 7:40 AM
>Subject: Re: [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-01.txt
> 
>Hi Bill,
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 07 Jun 2012 09:27:20 -0600

In general we cite the latest version unless you really need a
definition that's provided in the earlier version (which I doubt).

On 6/7/12 9:21 AM, William Mills wrote:
> I don't know the differences between the two, but for what I was
> referencing it's defined in both 2234 and 5234.  Does it matter which
> one I use?
> 
>     *From:* Peter Saint-Andre <[email-masked]>
>     *To:* William Mills <[email-masked]>
>     *Cc:* "[email-masked]" <[email-masked]>
>     *Sent:* Thursday, June 7, 2012 7:40 AM
>     *Subject:* Re: [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-01.txt
> 
>     Hi Bill,
> 
>     >    *From:* "[email-masked]
>     <mailto:[email-masked]>" <[email-masked]
>     <mailto:[email-masked]>>
>     >    *To:* [email-masked] <mailto:[email-masked]>
>     >    *Cc:* [email-masked] <mailto:[email-masked]>
>     <mailto:[email-masked] <mailto:[email-masked]>>

---

From: William Mills <[email-masked]>
Date: Thu, 7 Jun 2012 08:33:20 -0700 (PDT)

Fixed to 5234.  Thanks.

>Sent: Thursday, June 7, 2012 8:27 AM
>>     > This draft rips out the HTTP style format and in band discovery.
>>     > Feedback would be very welcome.
>>     >
>>     > Many thanks to Alexey for helping me get this posted.
>>     >
>>     > -bill
>>     >
>>     >
>>     >  
>>     >    *From:* "[email-masked]
>>     >    *To:* [email-masked] <mailto:[email-masked]>
>>     >    *Cc:* [email-masked] <mailto:[email-masked]>
>>     >    *Sent:* Wednesday, May 30, 2012 12:02 PM
>>     >    *Subject:* [kitten] I-D Action: draft-ietf-kitten-sasl-oauth-01.txt
>>     >
>>     >
>>     >    A New Internet-Draft is available from the on-line Internet-Drafts
>>     >    directories. This draft is a work item of the Common Authentication
>>     >    Technology Next Generation Working Group of the IETF.
>>     >
>>     >        Title          : A SASL and GSS-API Mechanism for OAuth
>>     >        Author(s)      : William Mills
>>     >                              Tim Showalter
>>     >                              Hannes Tschofenig
>>     >        Filename        : draft-ietf-kitten-sasl-oauth-01.txt
>>     >        Pages          : 21
>>     >        Date            : 2012-05-30
>>     >
>>     >      OAuth enables a third-party application to obtain limited
>>     access to a
>>     >      protected resource, either on behalf of a resource owner by
>>     >      orchestrating an approval interaction, or by allowing the
>>     third-party
>>     >      application to obtain access on its own behalf.
>>     >
>>     >      This document defines how an application client uses OAuth
>>     over the
>>     >      Simple Authentication and Security Layer (SASL) or the Generic
>>     >      Security Service Application Program Interface (GSS-API) to
>>     access a
>>     >      protected resource at a resource serve.  Thereby, it enables
>>     schemes
>>     >      defined within the OAuth framework for non-HTTP-based application
>>     >      protocols.
>>     >
>>     >      Clients typically store the user's long term credential. 
>>     This does,
>>     >      however, lead to significant security vulnerabilities, for
>>     example,
>>     >      when such a credential leaks.  A significant benefit of OAuth for
>>     >      usage in those clients is that the password is replaced by a
>>     token.
>>     >      Tokens typically provided limited access rights and can be
>>     managed
>>     >      and revoked separately from the user's long-term credential
>>     >      (password).
>>     >
>>     >
>>     >    A URL for this Internet-Draft is:
>>     >  
>>     >
>>     >    Internet-Drafts are also available by anonymous FTP at:
>>     >    ftp://ftp.ietf.org/internet-drafts/
>>     >
>>     >    This Internet-Draft can be retrieved at:
>>     >  
>>     >
>>     >    The IETF datatracker page for this Internet-Draft is:
>>     >    https://datatracker.ietf.org/doc/draft-ietf-kitten-sasl-oauth/
>>     >
>>     >    _______________________________________________
>>     >    Kitten mailing list
>>     >    [email-masked] <mailto:[email-masked]>
>>     >    https://www.ietf.org/mailman/listinfo/kitten
>>     >
>>     >
>>     >
>>     >
>>     > _______________________________________________
>>     > Kitten mailing list
>>     > [email-masked] <mailto:[email-masked]>
>>     > https://www.ietf.org/mailman/listinfo/kitten
>>     >
>> 
>
>
>