Subject: [OAUTH-WG] Which draft to use as a starting point for 'using a token'?

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 5 Feb 2010 00:28:45 -0700

On the call today I clarified what is going on with all the different drafts. In brief:

draft-hammer-oauth - documentation of the OAuth 1.0 Rev A (with changes) protocol. This is done and should be approved by the IESG shortly for publication.

draft-ietf-oauth-authentication - the part of OAuth 1.0 dealing with 'how to use a token after you obtain it'.
draft-ietf-oauth-web-delegation - the part of OAuth 1.0 rev A dealing with 'getting a token'.

draft-hammer-http-token-auth - an alternative proposal (meant to replace draft-ietf-oauth-authentication) which builds on top of OAuth 1.0 but cleans up the structure and removes the client credentials when accessing protected resources. It also changes how the request is normalized into a string before signing.

We have three options for moving forward with 'how to use a token'. Start with:

1. draft-ietf-oauth-authentication
2. draft-hammer-http-token-auth
3. something else*

* Do not suggest something else unless you are going to submit a proposal. It doesn't have to be an I-D, I am happy to do the editorial work but I will need a detailed proposal that is enough to turn into a specification.

Pick.

EHL

---

From: Dick Hardt <[email-masked]>
Date: Wed, 10 Feb 2010 19:53:21 -0800

How about using draft-hardt-oauth-wrap and adding a section for how the Client can sign?

-- Dick

On 2010-02-04, at 11:28 PM, Eran Hammer-Lahav wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 10 Feb 2010 23:27:08 -0700

> -----Original Message-----
> From: Dick Hardt [mailto:[email-masked]]
> Sent: Wednesday, February 10, 2010 7:53 PM

> How about using draft-hardt-oauth-wrap and adding a section for how the

We might end up with something that looks just like that, but your suggestions doesn't help me as an editor because you are offering a place to host the text and I am looking for the text itself.

WRAP doesn't have an 'how to use a token' section to build upon - anything that might go in there will need to be written from scratch (normalizing, signing, header structure, error handling, etc.). The challenge isn't finding a place to insert the 'using a token' text, but to find the best text to use as a foundation.

Once we figure that out, we will go through the same process for the 'how to get a token' text in which WRAP and the OAuth 1.0 text will be compared (along with any other proposals people wish to make).

When we have two stable drafts, we will have another discussion about merging the two drafts together. If WRAP ends up as the foundation for the other part, we will end up with your proposal.

EHL