Subject: [OAUTH-WG] Link relations for authenticating

From: Evert Pot <[email-masked]>
Date: Thu, 2 May 2019 23:41:50 -0400

Hi everyone!

I've been running into a number of situations where it would have been
beneficial to have a few protocol/media-type agnositic link relation
types for user authentication purposes.

https://tools.ietf.org/html/draft-pot-authentication-link

Nothing here is coupled to OAuth, but the link relations could
potentially be used with OAuth2 servers.

I don't exactly know the IETF process, but I thought it would be a good
idea to ask for feedback here. My understanding is that either I should
find an appropriate WG that's willing to adopt it, or I could do an
individual submission. I'm not entirely sure yet which would be the most
appropriate WG to ask, so I thought I'd start here.

Evert

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 6 May 2019 12:38:36 -0500

Hi Evert,

> appropriate WG to ask, so I thought I'd start here.

You may want to ask for feedback on [email-masked]
(https://www.ietf.org/mailman/listinfo/art) as well -- there are several
folks there that have deep expertise in link relations and could advise on
what these proposals might (or might not) be suitable for.

There are a few other security-area WGs (than OAuth) that work in
authentication (though maybe not as directly in the HTTP world), so once
you get some ART feedback it may be worth raising the issue on the
secdispatch mailing list as well
(https://datatracker.ietf.org/wg/secdispatch/about/).

Thanks,

Ben

---

From: Evert Pot <[email-masked]>
Date: Mon, 6 May 2019 14:22:50 -0400

Hi Benjamin,

Thanks for the hint. Will give that a shot!

Evert

---

From: Neil Madden <[email-masked]>
Date: Mon, 6 May 2019 19:35:50 +0100

I don’t know the relative merits of Link headers vs .well-known, but there is at least one other draft standard I know of that is going down the .well-known route for this kind of thing (password changes in this case):

https://github.com/WICG/change-password-url/blob/gh-pages/explainer.md

— Neil

> On 3 May 2019, at 04:41, Evert Pot <[email-masked]> wrote:
> 
> Hi everyone!
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Evert Pot <[email-masked]>
Date: Sun, 12 May 2019 15:17:21 -0400

On 2019-05-06 2:35 p.m., Neil Madden wrote:
> I don’t know the relative merits of Link headers vs .well-known, but
> there is at least one other draft standard I know of that is going
> down the .well-known route for this kind of thing (password changes in
> this case):
>

Hi Neil,

The RFC describes this a bit:
https://tools.ietf.org/html/rfc5785#section-3

The prime use-case for me is finding domain-wide services, especially in
cases where no full context-uri exists. A great example is answering the
question: Where is the CalDAV server for a given email address. Given
that an email address only has a hostname and not a full uri,
.well-known is a good way to find related services.

But .well-known doesn't really do everything that Web Linking (rfc8288)
does, and for people like me that want to build web services and
standards on the web, creating new relationship types is really the way
to go.

They're also pretty low risk and simple to register. They just need a
stable specification, and a RFC is great for this.

I actually do intend to use this with OAuth2, because I want my resource
services to link to an oauth2 authorization endpoint via the
'authentication' link.

Evert