Subject: [OAUTH-WG] Fwd: Is OAUTHV2-HTTP_MAC dead?

From: Rex Albert <[email-masked]>
Date: Wed, 10 Sep 2014 14:27:24 +0530

Hi,
We are looking at implementing OAUTHV2-HTTP-MAC whose draft is in an
expired state.( http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-05)  Is
it dead or is it going to be a standard anytime? or are we going to
implement at our own risk? or is there a better standard/draft ( alive )
which might supersede this draft ?

thank you for your time.
I am a newbie to the IETF draft process and kindly excuse my naivety.
-rex

---

From: Sergey Beryozkin <[email-masked]>
Date: Wed, 10 Sep 2014 10:49:43 +0100

Hi
On 10/09/14 09:57, Rex Albert wrote:
> expired
> state.(http://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-05)  Is

It's not going to be revived. Does not mean though one can not use the 
idea for implementing custom OAuth2 token schemes, IMHO it was a very 
simple and effective 'PoP' approach, and it is easy to document and 
support. FYI, we support a Hawk scheme (not part of OAuth2 work at all, 
kind of 'draft-ietf-oauth-v2-http-mac-06') as an access token scheme in 
our project.

As far as I understand new proof-of-possession documents the group is 
working upon will offer the alternative standard solutions.

Cheers, Sergey

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Rex Albert <[email-masked]>
Date: Wed, 10 Sep 2014 13:30:05 +0530

Hi,

thank you for your time.

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 10 Sep 2014 17:56:51 +0200

Hi Rex,

the document <draft-ietf-oauth-v2-http-mac-05> has been superseded by
the PoP work (which was subsequently split into various other documents).

That, however, does not mean that the content is dead. The mechanism for
the authorization server to convey the symmetric key to the client is
now documented in <draft-ietf-oauth-pop-key-distribution>. The high
level description / overview is now documented in
<draft-ietf-oauth-pop-architecture>. The actual mechanism for the client
to apply the key to the request to the resource server is now documented
in <draft-ietf-oauth-signed-http-request>.

While < draft-ietf-oauth-signed-http-request> today is different to the
mechanism described in <draft-ietf-oauth-v2-http-mac-05> it also has to
be said that it is the weakest document in the entire document set at
the moment.

So, there is still a chance to incorporate your design requirements into
the appropriate parts of the work since the work is still in progress.

It would be good to know what your requirements/interests are.

Ciao
Hannes

---

From: Rex Albert <[email-masked]>
Date: Thu, 11 Sep 2014 13:45:57 +0530

Hi Hannes,
thank you very much for the response and it is very useful to have such
detailed information. thank you again for that.
I am now reading about PoP and it is very interesting and also seeing HTTP
signature as well.
Our requirement in short - to achieve seamless authentication and
authorization among HTTP - REST based web services within a protected
network with a secure channel for communication, without human intervention
and without compromise on the time taken to process each request.
Kindly let me know if you need further details .
thanks again
-rex

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 11 Sep 2014 23:38:30 +0200

Hi Rex,

On 09/11/2014 10:15 AM, Rex Albert wrote:
> I am now reading about PoP and it is very interesting and also seeing
> HTTP signature as well. 

Thanks for looking at the document. Please provide comments, if you run
into questions or bugs.

> network with a secure channel for communication, without human
> intervention and without compromise on the time taken to process each
> request. 

I think we are getting there.

> Kindly let me know if you need further details . 

Particuarly for the HTTP signature approach we need input since it is
still not close to getting finalized.

It would also be great if you also have some possibility to provide
implementation feedback.

Ciao
Hannes

> On Wed, Sep 10, 2014 at 9:26 PM, Hannes Tschofenig
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     Hi Rex,
> 
>     >> [email-masked] <mailto:[email-masked]>
>     > [email-masked] <mailto:[email-masked]>