Subject: [kitten] Comments on draft-ietf-kitten-sasl-oauth-02

From: Ryan Troll <[email-masked]>
Date: Mon, 6 Aug 2012 09:50:41 -0700

Reviewing the latest draft, I had two comments:

*Signature Calculation*
In the last paragraph of section 3.1, the user field should be included in
the signature.

*Bearer Token Format*

According to draft-ietf-oauth-v2-bearer<http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-22>,
section 2.1, the credential in the Authorization header is formatted as:

b64token    = 1*( ALPHA / DIGIT /
                       "-" / "." / "_" / "~" / "+" / "/" ) *"="
credentials = "Bearer" 1*SP b64token

for example:

Bearer mF_9.B5f-4.1JqM

Should the SASL Auth mechanism follow the same format?  If so, the example
in section 5.1 should be changed to:

auth=Bearer vF9dft4qmTc2Nvb3RlckBhbHRhdmlzdGEuY29tCg==^A^A

This removes the quotes, and uses the same casing fror "Bearer" as defined
in the draft.

-R

---

From: William Mills <[email-masked]>
Date: Mon, 6 Aug 2012 10:27:52 -0700 (PDT)

>________________________________
> From: Ryan Troll <[email-masked]>
>To: [email-masked] 
>Sent: Monday, August 6, 2012 9:50 AM
>Subject: [kitten] Comments on draft-ietf-kitten-sasl-oauth-02
> 
>

Thank you for the review :)

>
>Signature Calculation
>In the last paragraph of section 3.1, the user field should be included in the signature.
>

I don't think so.  The user field is a hint, and not authoritative.  Also, there's no way to get it into OAuth 1.0a.  If we want it there we have to put user in the path, query string, or post args.

>
>Bearer Token Format
>
>According to draft-ietf-oauth-v2-bearer, section 2.1, the credential in the Authorization header is formatted as:
>
>>
>Should the SASL Auth mechanism follow the same format?  If so, the example in section 5.1 should be changed to:
>
>This removes the quotes, and uses the same casing fror "Bearer" as defined in the draft.
>

Removed the quotes.  

Case is an interesting question.  Authorization header scheme names are case insensitive.  I'm happy to make this consistent, but I relly don't want folks to get hung up on the examples rather than the actual spec.  What's the right thing here, add a note?

---

From: William Mills <[email-masked]>
Date: Mon, 6 Aug 2012 10:35:45 -0700 (PDT)

And I need to fix all the examples now to add the user header.

----- Original Message -----
> From: William Mills <[email-masked]>
> To: Ryan Troll <[email-masked]>; "[email-masked]" <[email-masked]>
> Cc: 
> Sent: Monday, August 6, 2012 10:27 AM
> Subject: Re: [kitten] Comments on draft-ietf-kitten-sasl-oauth-02
> 
> I don't think so.  The user field is a hint, and not authoritative.  Also, 
> there's no way to get it into OAuth 1.0a.  If we want it there we have to 
> put user in the path, query string, or post args.
> 
> 
>> 
>> Bearer Token Format
>> 
> Case is an interesting question.  Authorization header scheme names are case 
> insensitive.  I'm happy to make this consistent, but I relly don't want 
> folks to get hung up on the examples rather than the actual spec.  What's 
> the right thing here, add a note?
> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten
>

---

From: William Mills <[email-masked]>
Date: Mon, 6 Aug 2012 15:19:09 -0700 (PDT)

Not to be over anxious, but posted a new draft.

---

From: William Mills <[email-masked]>
Date: Mon, 6 Aug 2012 21:43:30 -0700 (PDT)

It is a fascinating thing to be implementing my own spec, and going back and referring to it and finding things to fix where I thought it was just fine...

>Sent: Monday, August 6, 2012 3:19 PM