Subject: [OAUTH-WG] Another draft update

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 7 Apr 2010 16:26:06 -0700

Latest is always at:

http://github.com/theRazorBlade/draft-ietf-oauth

(xml is always up to date. txt and html when I can. Atom feed available)

---

I finished going over sections 1-4 which includes the overview, flows, and
refresh method. Next is using tokens. By finished I mean those sections are
ready to be submitted as a working group draft -00.

Unfortunately I am unable (or unwilling) to go back and review comments made
to sections I previously ignored. Please review sections 1-4 again and
submit any changes needed for a -00 draft. This means focus on critical
changes that should be made before the document is considered a starting
point for the working group.

Open issues:

* token size limit
* restriction on values characters
* specificity of the assertion flow
* parameter name prefix
* single authorization endpoint
* inclusion of both user-agent flow and native application flow
* requiring HTTPS for bearer token protected resource requests
* username parameter proposal
* scope parameter
* adding refresh token as optional in all access token requests
* limiting signed requests to use the auth header (no query / form body)

Once we approve this as -00 I plan to post a weekly draft based on the
feedback received and approved by the group. I will no longer make changes
to the draft (after -00) without working group consensus.

Please (PLEASE) don't reply to this message with feedback but instead send a
separate post for each major issue. Feel free to bunch small comments into
one post. This will help facilitate our discussion.

The spec is now 50 pages before adding the security consideration and
signature workflow. Its big. I would appreciate any feedback you can spare
so we can decide next week if it is ready for a -00.

Thanks!

EHL

---

From: Dick Hardt <[email-masked]>
Date: Wed, 7 Apr 2010 17:23:10 -0700

> * limiting signed requests to use the auth header (no query / form body)

Are these issues where you expect to have a consensus vote and you are only looking for other issues, or are you looking for feedback on these as separate emails as well?

-- Dick

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Wed, 7 Apr 2010 22:57:54 -0700

On 4/7/10 5:23 PM, "Dick Hardt" <[email-masked]> wrote:

> Are these issues where you expect to have a consensus vote and you are only
> looking for other issues, or are you looking for feedback on these as separate
> emails as well?

I just listed all the issues people reported which were not (yet) addressed
in the draft. I didn't want to give the impression that by not addressing
them, some decision has been made. I expect us to continue to debate them
and hope that consensus will emerge or that the chairs will start working
more actively to resolve them.

So yes, please do provide feedback on these or any other issues you have.

As for reaching consensus, I will leave it up to the chairs to decide their
favorite method, but what worked well for us in the past is to make a
statement that reflects what the majority seems to want with the reasons for
and against and then ask if someone has *strong* objections.

And this is not limited to the chairs. If you feel a position you agree with
has consensus, please do sum it up and ask if people are ok moving forward
with that view. The key is that you need to have *strong* objections, not
just keep pointing out that something can be slightly better.

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 12 Apr 2010 05:31:51 -0700

Latest is always at:

---

I finished going over sections 1-5 which includes the overview, flows, refresh method, and using tokens (including signatures). By finished I mean those sections are ready to be submitted as a working group draft -00.

Please review sections 1-5 and submit any changes needed for a -00 draft. This means focus on critical changes that should be made before the document is considered a starting point for the working group.

I am going to ask the chairs for a consensus call about promoting this to a working group draft by 4/19 so please submit feedback as soon as possible.

Open issues:

* token size limit

Closed issues:

Once we approve this as -00 I plan to post a weekly draft based on the feedback received and approved by the group. I will no longer make changes to the draft (after -00) without working group consensus.

Please (PLEASE) don't reply to this message with feedback but instead send a separate post for each major issue. Feel free to bunch small comments into one post. This will help facilitate our discussion.

The spec is now 51 pages before adding the security consideration and error codes. It's big. I would appreciate any feedback you can spare
so we can decide next week if it is ready for a -00.

Thanks!

EHL

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 16 Apr 2010 20:28:28 -0700

Latest is always at:

---

Latest changes:

- Split authorization endpoint to authorization and token endpoints.
- Shortened type parameter values to just the flow name.
- Removed the Native Application flow.
- Renamed Web Callback flow (back) to Web Server flow.
- Made client secret optional in  Web Server flow.
- Moved User-Agent flow to top of list.
- Renamed 'redirection' and 'callback' to 'redirect_uri'.
- A few other small things I can't recall...

Please review sections 1-5 and submit any changes needed for a -00 draft.
This means focus on critical changes that should be made before the document
is considered a starting point for the working group.

I have asked the chairs for a consensus call about promoting this to a
working group draft on 4/19 so please submit feedback as soon as possible
(you had a few weeks already).

Open issues:

* restriction on token string characters
* specificity of the assertion flow
* parameter name prefix
* username parameter proposal
* scope parameter
* limiting signed requests to use the auth header (no query / form body)
* separation of client authentication from flows

Closed issues:

Thanks!

EHL