Subject: Re: [OAUTH-WG] Call for agenda items

From: William Denniss <[email-masked]>
Date: Mon, 05 Mar 2018 18:30:22 +0000

Hannes & Rifaat,

I would like the opportunity to present on OAuth 2.0 Incremental
Authorization (draft-wdenniss-oauth-incremental-auth) [an update for which
will be posted today] and "OAuth 2.0 Device Posture Signals"
(draft-wdenniss-oauth-device-posture).

I can also give an update on the status of Device Flow
(draft-ietf-oauth-device-flow). I expect that to be short now that WGLC has
concluded and the document has advanced.

Little late to this thread and I see we already have 2 sessions in the
draft agenda, but I'd like to add my support to keeping both sessions,
there's always a lot to discuss and in the past we've been able to use any
spare time to discuss the security topics of the day.

Regards,
William

On Tue, Jan 30, 2018 at 4:40 AM Hannes Tschofenig <[email-masked]>
wrote:

> Hi all,
>
>
>
> It is time already to think about the agenda for the next IETF meeting.
> Rifaat and I were wondering whether we need one or two sessions. We would
> like to make the decision based on the topics we will discuss. Below you
> can find a first version of the agenda with a few remarks. Let us know if
> you have comments or suggestions for additional agenda items.
>
>
>
> Ciao
> Hannes & Rifaat
>
>
>
> OAuth Agenda
>
> ------------
>
>
>
> - Welcome and Status Update  (Chairs)
>
>
>
>   * OAuth Security Workshop Report
>
>
>
>   * Documents in IESG processing
>
>      # draft-ietf-oauth-device-flow-07
>
>      # draft-ietf-oauth-discovery-08
>
>      # draft-ietf-oauth-jwsreq-15
>
>      # draft-ietf-oauth-token-exchange-11
>
>
>
>        Remark: Status updates only if needed.
>
>
>
> -  JSON Web Token Best Current Practices
>
>    # draft-ietf-oauth-jwt-bcp-00
>
>
>
>    Remark: We are lacking reviews on this document.
>
>    Most likely we will not get them during the f2f meeting
>
>    but rather by reaching out to individuals ahead of time.
>
>
>
> -  OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access
> Tokens
>
>    # draft-ietf-oauth-mtls-06
>
>
>
>    Remark: Could be completed by the time of the IETF meeting.
>
>
>
> - OAuth Security Topics
>
>   # draft-ietf-oauth-security-topics-04
>
>
>
>   Remark: We could do a consensus call on parts of the document soon.
>
>
>
> - OAuth 2.0 Token Binding
>
>   # draft-ietf-oauth-token-binding-05
>
>
>
>   Remark: Document is moving along but we are lacking implementations.
>
>
>
> - OAuth 2.0 Device Posture Signals
>
>   # draft-wdenniss-oauth-device-posture-01
>
>
>
>   Remark: Interest in the work but we are lacking content (maybe even
>
>   expertise in the group)
>
>
>
> - Reciprocal OAuth
>
>   # draft-hardt-oauth-mutual-02
>
>
>
>   Remark: We had a virtual interim meeting on this topic and there is
>
>   interest in this work and apparently no competing solutions. The plan
>
>   is to run a call for adoption once we are allowed to add a new milestone
>
>   to our charter.
>
>
>
> - Distributed OAuth
>
>   # draft-hardt-oauth-distributed-00
>
>
>
>   Remark: We had a virtual interim meeting on this topic and there is
>
>   interest in this work. Further work on the scope is needed.
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 5 Mar 2018 19:53:34 +0000

I should make a presentation about changes in draft-ietf-oauth-discovery that occurred because of IESG feedback.  10-15 minutes.

I will try to have something to say about the JWT BCP draft, which is currently expired.  I will plan to address Brian Campbell’s comments before London.  (Not enough time remains to do it today.)  10-15 minutes.

                                                                -- Mike

From: OAuth <[email-masked]> On Behalf Of William Denniss
Sent: Monday, March 5, 2018 10:30 AM
To: Hannes Tschofenig <[email-masked]>
Cc: oauth <[email-masked]>
Subject: Re: [OAUTH-WG] Call for agenda items

Hannes & Rifaat,

I would like the opportunity to present on OAuth 2.0 Incremental Authorization (draft-wdenniss-oauth-incremental-auth) [an update for which will be posted today] and "OAuth 2.0 Device Posture Signals" (draft-wdenniss-oauth-device-posture).

I can also give an update on the status of Device Flow (draft-ietf-oauth-device-flow). I expect that to be short now that WGLC has concluded and the document has advanced.

Little late to this thread and I see we already have 2 sessions in the draft agenda, but I'd like to add my support to keeping both sessions, there's always a lot to discuss and in the past we've been able to use any spare time to discuss the security topics of the day.

Regards,
William

On Tue, Jan 30, 2018 at 4:40 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi all,

It is time already to think about the agenda for the next IETF meeting. Rifaat and I were wondering whether we need one or two sessions. We would like to make the decision based on the topics we will discuss. Below you can find a first version of the agenda with a few remarks. Let us know if you have comments or suggestions for additional agenda items.

Ciao
Hannes & Rifaat

OAuth Agenda
------------

-  OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens
   # draft-ietf-oauth-mtls-06

- OAuth Security Topics

- Reciprocal OAuth

- Distributed OAuth

  Remark: We had a virtual interim meeting on this topic and there is
  interest in this work. Further work on the scope is needed.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Nat Sakimura <[email-masked]>
Date: Tue, 06 Mar 2018 01:09:46 +0000

I would be interested in hearing that.

Also, as part of "Distributed OAuth", can we do a bit of re-cap on some of
the previous drafts on the similar topic as we discussed in the interim?
i.e., Brian's draft (where is the link now?) and my draft (
draft-sakimura-oauth-meta
<https://tools.ietf.org/id/draft-sakimura-oauth-meta-08.txt>)?

Best,

Nat

On Tue, Mar 6, 2018 at 3:30 AM William Denniss <[email-masked]> wrote:

> On Tue, Jan 30, 2018 at 4:40 AM Hannes Tschofenig <
> [email-masked]> wrote:
>
>> Hi all,
>>
>>
>>
-- 

Nat Sakimura

Chairman of the Board, OpenID Foundation

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 6 Mar 2018 10:22:32 -0500

Nat,

During the interim meeting, 3 drafts mentioned in the context of *Distributed
OAuth*:

https://tools.ietf.org/html/draft-sakimura-oauth-meta-08
https://tools.ietf.org/html/draft-campbell-oauth-resource-indicators-02
https://tools.ietf.org/html/draft-tschofenig-oauth-audience-00

*Brian, Hannes,*

Are you planning on presenting your documents?

Regards,
 Rifaat

On Mon, Mar 5, 2018 at 8:09 PM, Nat Sakimura <[email-masked]> wrote:

>> Authorization (draft-wdenniss-oauth-incremental-auth) [an update for
>> which will be posted today] and "OAuth 2.0 Device Posture Signals"
>> (draft-ietf-oauth-device-flow). I expect that to be short now that WGLC
>> has concluded and the document has advanced.
>>

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 6 Mar 2018 15:34:35 +0000

I could do that, if it helps.

From: Rifaat Shekh-Yusef [mailto:[email-masked]]
Sent: 06 March 2018 16:23
To: Nat Sakimura
Cc: Hannes Tschofenig; William Denniss; oauth
Subject: Re: [OAUTH-WG] Call for agenda items

Nat,

During the interim meeting, 3 drafts mentioned in the context of Distributed OAuth:

Brian, Hannes,

Regards,
 Rifaat

On Mon, Mar 5, 2018 at 8:09 PM, Nat Sakimura <[email-masked]<mailto:[email-masked]>> wrote:
I would be interested in hearing that.

Also, as part of "Distributed OAuth", can we do a bit of re-cap on some of the previous drafts on the similar topic as we discussed in the interim? i.e., Brian's draft (where is the link now?) and my draft (draft-sakimura-oauth-meta<https://tools.ietf.org/id/draft-sakimura-oauth-meta-08.txt>)?

Best,

Nat

On Tue, Mar 6, 2018 at 3:30 AM William Denniss <[email-masked]<mailto:[email-masked]>> wrote:
Hannes & Rifaat,

Regards,
William

Ciao
Hannes & Rifaat

OAuth Agenda
------------

- OAuth Security Topics

- Reciprocal OAuth

- Distributed OAuth

Nat Sakimura

---

From: Brian Campbell <[email-masked]>
Date: Tue, 6 Mar 2018 09:31:16 -0700

I hadn't previously been planning on it but am happy to do so.

On Tue, Mar 6, 2018 at 8:22 AM, Rifaat Shekh-Yusef <[email-masked]>
wrote:

>> Also, as part of "Distributed OAuth", can we do a bit of re-cap on some
>> of the previous drafts on the similar topic as we discussed in the interim?

-- 
*CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you.*

---

From: n-sakimura <[email-masked]>
Date: Wed, 7 Mar 2018 07:00:05 +0000

Then let us do it. We need to put all the proposals on the table and strategize the design.
Perhaps we need a side meeting as well.

nat

From: OAuth [mailto:[email-masked]] On Behalf Of Brian Campbell
Sent: Wednesday, March 07, 2018 1:31 AM
To: Rifaat Shekh-Yusef <[email-masked]>
Cc: oauth <[email-masked]>
Subject: Re: [OAUTH-WG] Call for agenda items

On Tue, Mar 6, 2018 at 8:22 AM, Rifaat Shekh-Yusef <[email-masked]<mailto:[email-masked]>> wrote:
Nat,

Brian, Hannes,

Regards,
 Rifaat

Best,

Nat

Regards,
William

Ciao
Hannes & Rifaat

OAuth Agenda
------------

- OAuth Security Topics

- Reciprocal OAuth

- Distributed OAuth

Nat Sakimura

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 7 Mar 2018 07:22:23 -0500

Nat,

Are you asking for an interim meeting?
We could schedule the Distributed OAuth discussion for the Wednesday
meeting; that will give you guys sometime to discuss these face-to-face in
London.

Regards,
 Rifaat

On Wed, Mar 7, 2018 at 2:00 AM, n-sakimura <[email-masked]> wrote:

> *From:* OAuth [mailto:[email-masked]] *On Behalf Of *Brian
> Campbell
> *Sent:* Wednesday, March 07, 2018 1:31 AM
> *To:* Rifaat Shekh-Yusef <[email-masked]>
> *Cc:* oauth <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Call for agenda items
>
>
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*
>

---

From: n-sakimura <[email-masked]>
Date: Thu, 8 Mar 2018 01:52:38 +0000

No, not really. I was thinking of more informal thing. The session is supposed to be Wednesday afternoon, so I was thinking that it might be a good idea to do a bit of recap among contributors to draw up a battle plan towards IETF 102.

Nat

From: Rifaat Shekh-Yusef [mailto:[email-masked]]
Sent: Wednesday, March 07, 2018 9:22 PM
To: n-sakimura <[email-masked]>
Cc: Brian Campbell <[email-masked]>; oauth <[email-masked]>
Subject: Re: [OAUTH-WG] Call for agenda items

Nat,

Are you asking for an interim meeting?
We could schedule the Distributed OAuth discussion for the Wednesday meeting; that will give you guys sometime to discuss these face-to-face in London.

Regards,
 Rifaat

On Wed, Mar 7, 2018 at 2:00 AM, n-sakimura <[email-masked]<mailto:[email-masked]>> wrote:
Then let us do it. We need to put all the proposals on the table and strategize the design.
Perhaps we need a side meeting as well.

nat

From: OAuth [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Brian Campbell
Sent: Wednesday, March 07, 2018 1:31 AM
To: Rifaat Shekh-Yusef <[email-masked]<mailto:[email-masked]>>
Cc: oauth <[email-masked]<mailto:[email-masked]>>
Subject: Re: [OAUTH-WG] Call for agenda items

Brian, Hannes,

Regards,
 Rifaat

Best,

Nat

Regards,
William

Ciao
Hannes & Rifaat

OAuth Agenda
------------

- OAuth Security Topics

- Reciprocal OAuth

- Distributed OAuth

Nat Sakimura