Subject: [OAUTH-WG] Setting Course

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 13 Jan 2010 17:53:39 -0700

I think the goal of the next two months is to produce two semi-stable drafts
covering the two parts of the protocol:

1. Authentication - how to make authenticated requests / signed messages
using token credentials. This will be based on my token auth draft [1] as a
starting point. There are a few open issues to decide based on feedback
received from Panzer and Eaton which I will post about shortly.

2. Authorization - how to obtain a set of token credentials using web
redirection and other flows introduced by WRAP. This will be a new draft
using the web-delegation draft [2] skeleton and the flows in WRAP section 5
[3]. There are many open issues to decide, starting with which flows to
keep, which to move to an extension, and if there are additional ones to
add.

These drafts will be locked before the WG meeting to allow review and will
be discussed at the meeting. We will also discuss any charter changes
required to accommodate the drafts. This approach will allow us to focus on
the work and worry about the charter at the meeting. This will ensure we
ground the process in actual technical consensus.

Comments?

EHL

[1] http://tools.ietf.org/html/draft-hammer-http-token-auth
[2] http://tools.ietf.org/html/draft-ietf-oauth-web-delegation
[3] http://bit.ly/oauth-wrap

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 13 Jan 2010 19:17:46 -0700

<hat type='chair'/>

> ground the process in actual technical consensus.

That approach sounds quite reasonable. Two comments:

a. In my opinion the scenarios are not limited to what has been
introduced by the WRAP discussions, and I have been encouraging folks to
submit I-Ds that document additional scenarios as input to our
understanding of the problem space (the WRAP authors will submit their
work soon, as well).

b. Once we have a clear grasp of the problem space, we'll be able to
make longer-lasting progress on solutions. As you have outlined, at a
high level the solutions are how to make authenticated requests and how
to obtain credentials for making such requests, but it seems to me that
there's still quite a bit of work to be done in figuring out what's
"core" to those solutions and what needs to go in various extensions.

Blaine and I will send out a rough agenda tomorrow for our first
conference call on the 21st.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 13 Jan 2010 23:12:27 -0700

> understanding of the problem space (the WRAP authors will submit their

Exactly. That's why I asked if there are additional ones to add. But I think
it is important the people will read the WRAP scenarios before spending time
in writing new I-Ds to see if their *use-case* is already covered. If it is,
but is not solved to their satisfaction, I think that should be posted as
feedback to the WRAP proposal and not as yet another I-D.

> "core" to those solutions and what needs to go in various extensions.

This is true for the authorization part, but I don't think it is true for
the authentication part. On the authentication side I think we are very
close to a proposal. I have followed up with a few open questions and will
send more over the next few days.

I think we can get the authentication part mostly done quickly, and then put
it aside to focus on the authorization, going back to make changes as
limitations or issues are found based on the authorization experience.

> conference call on the 21st.

Great. I will not be able to attend but hopefully others will and report
back with new ideas and feedback.

EHL

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 15 Jan 2010 14:41:58 -0700

> feedback to the WRAP proposal and not as yet another I-D.

Indeed. My sense from talking with some folks one-on-one is that there
are additional scenarios, and I'm encouraging those people to contribute
scenarios on the list or via I-D.

> limitations or issues are found based on the authorization experience.

Iterative development is good. :) That sounds quite reasonable.

>> conference call on the 21st.

Sorry we haven't sent it yet -- we're working on it now...

> back with new ideas and feedback.

Sorry to hear that. Hopefully you'll be able to join future calls.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: David Recordon <[email-masked]>
Date: Fri, 15 Jan 2010 20:06:04 -0800

Yes, those two drafts make sense.  From other threads it sounds like
we're making progress on the Authentication draft which will both
support signatures (ala OAuth 1.x) and plaintext plus SSL/TLS (ala
WRAP).  I'll try to start working toward consensus on the core flows
we'd like to support in the Authorization draft next week.

--David

On Wed, Jan 13, 2010 at 4:53 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>