Subject: Re: [OAUTH-WG] terminology

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 02 Feb 2010 15:08:24 -0700

On 1/28/10 11:35 PM, David Recordon wrote:
> Hey Peter,
> Luke put together a spreadsheet comparing the terminology across five or
> six different protocols.  Hopefully he'll share it. :)

That would be great. I'll ping him off-list, or he can just attach it to
http://trac.tools.ietf.org/wg/oauth/trac/wiki/OauthTerms by first
provisioning an account at http://tools.ietf.org/newlogin :)

> I have a pretty strong preference of sticking with OAuth 1.0 terminology
> as much as possible.

Agreed.

---

From: Dick Hardt <[email-masked]>
Date: Tue, 2 Feb 2010 14:12:52 -0800

>> I have a pretty strong preference of sticking with OAuth 1.0 terminology

The term "server" in OAuth 1.0 does not differentiate between the Authorization Server and Protected Resource as are differentiated in OAuth WRAP.

The terms used in OAuth WRAP are a superset of OAuth 1.0 with changes to provide additional clarity.

-- Dick

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 02 Feb 2010 15:41:16 -0700

On 2/2/10 3:12 PM, Dick Hardt wrote:
>>> I have a pretty strong preference of sticking with OAuth 1.0
>>> terminology as much as possible.
>> 
>> Agreed.
> 
> The term "server" in OAuth 1.0 does not differentiate between the
> Authorization Server and Protected Resource as are differentiated in
> OAuth WRAP.
> 

I meant to say "agreed, where possible and reasonable". The point of
this exercise is to make sure that we differentiate where that makes
sense. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Eve Maler <[email-masked]>
Date: Tue, 2 Feb 2010 15:16:30 -0800

Related to this, in UMA we chose "Host" for the online service where a protected resource can be accessed, because each resource found there might potentially be subject to a different user-managed authorization policy (that is, protection) regime.  We've found this word to be quite copacetic, as it's short and intuitive, has a unique single-letter abbreviation, and doesn't imply that the service is the same thing as a particular resource available at the service.

At first, we tried to stick with "SP" for this entity -- this was before the server/client terminology emerged in the OAuth 1.0 cleanup effort -- but found it to be too confusing because the Host has an OAuth-mediated relationship with the UMA Authorization Manager (note, not the same thing as a WRAP Authorization Server!) that is consumer->SP / client->server.

I wonder if "Host" can work in the context of the WRAP patterns too, since all the same things are true about this word in both contexts...

BTW, here's a direct link to the UMA terminology section:

http://kantarainitiative.org/confluence/display/uma/UMA+1.0+Core+Protocol#UMA1.0CoreProtocol-Terminology

	Eve

> this exercise is to make sure that we differentiate where that makes

Eve Maler
[email-masked]
http://www.xmlgrrl.com/blog

---

From: David Recordon <[email-masked]>
Date: Wed, 3 Feb 2010 00:30:13 -0800

Looks like
http://spreadsheets.google.com/ccc?key=0AjpBrc9X0st3dFBNQUpnZzFJbmFGOTkxZUVNdGdxMmc&hl=enis
actually public.

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 03 Feb 2010 06:02:39 -0700

Yes, that is quite helpful. Thanks!

On 2/3/10 1:30 AM, David Recordon wrote:
> Looks
> like http://spreadsheets.google.com/ccc?key=0AjpBrc9X0st3dFBNQUpnZzFJbmFGOTkxZUVNdGdxMmc&hl=en
> <http://spreadsheets.google.com/ccc?key=0AjpBrc9X0st3dFBNQUpnZzFJbmFGOTkxZUVNdGdxMmc&hl=en>
> is actually public.
> 
> On Tue, Feb 2, 2010 at 2:08 PM, Peter Saint-Andre <[email-masked]
> <mailto:[email-masked]>> wrote:
>