Subject: [OAUTH-WG] XYZ and Transactional OAuth

From: Justin Richer <[email-masked]>
Date: Mon, 6 May 2019 19:43:30 +0000

In a vein related to Torsten’s recent thread and blog post, I’ve also been working on a proposal around Transactional OAuth. As many of you know, I wrote a blog post about the basic idea last fall, and now I’ve got something a bit more concrete online that people can poke around with. I’m calling it “XYZ” just to give it a name, and it’s online here:

https://oauth.xyz/

I need to be very clear: This is not wire-compatible with OAuth2, but is instead a transactional (intent-pattern) protocol that implements a lot of the core concepts and a few new ones in a different framework. There have been a lot of attempts to extend and adapt OAuth in the last few years, and in my opinion that’s gotten us painted into a bit of a corner as we keep trying to solve new problems. By breaking away from backwards compatibility, I found that was able to both simplify a lot of the concepts, make different actions more consistent, and make it more widely flexible.

Also to note, I’ve read through Torsten’s draft, and I think that his ideas of what’s in a “Structured Scope” could be a replacement for the hand-waving idea I have in the “resources” section of XYZ. I’m continuing development of this protocol, including a couple toy implementations, all of them open source. I have started a writeup in spec-language, and I plan to have it cleaned up and submitted prior to Montreal — where I’ll be attending in person and hope to discuss this as a potential WG item.

— Justin

---

From: Hans Zandbelt <[email-masked]>
Date: Mon, 6 May 2019 21:42:58 +0100

OAuth 2.0 has its merits and will be around for the next 20 years or so;
yet we're bumping into its limitations every day if not only for its
complexity and the incomprehensibility for regular IT peeps that don't have
the full historical background; support for transactions is obviously
missing today; I'm in for simplifying things, collapsing request
parameters, use cases, PCKE, POP etc. in a non-backwards compatible
protocol and suggest to adopt something similar to what you propose to
become OAuth 3.0 (there, I said it ;-))

Hans.

On Mon, May 6, 2019 at 8:44 PM Justin Richer <[email-masked]> wrote:

> In a vein related to Torsten’s recent thread and blog post, I’ve also been
> working on a proposal around Transactional OAuth. As many of you know, I
> wrote a blog post about the basic idea last fall, and now I’ve got
> something a bit more concrete online that people can poke around with. I’m
> calling it “XYZ” just to give it a name, and it’s online here:
>
> https://oauth.xyz/
>
> I need to be very clear: This is not wire-compatible with OAuth2, but is
> instead a transactional (intent-pattern) protocol that implements a lot of
> the core concepts and a few new ones in a different framework. There have
> been a lot of attempts to extend and adapt OAuth in the last few years, and
> in my opinion that’s gotten us painted into a bit of a corner as we keep
> trying to solve new problems. By breaking away from backwards
> compatibility, I found that was able to both simplify a lot of the
> concepts, make different actions more consistent, and make it more widely
> flexible.
>
> Also to note, I’ve read through Torsten’s draft, and I think that his
> ideas of what’s in a “Structured Scope” could be a replacement for the
> hand-waving idea I have in the “resources” section of XYZ. I’m continuing
> development of this protocol, including a couple toy implementations, all
> of them open source. I have started a writeup in spec-language, and I plan
> to have it cleaned up and submitted prior to Montreal — where I’ll be
> attending in person and hope to discuss this as a potential WG item.
>
> — Justin
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
[email-masked]
ZmartZone IAM - www.zmartzone.eu

---

From: Justin Richer <[email-masked]>
Date: Tue, 7 May 2019 12:55:24 +0000

OAuth 2 is definitely not going anywhere any time soon. It solves a suite of problems really well, in a way that developers can get right more often than not. Even so, I think it’s time to start looking toward what’s next. It’s not up to me whether this deserves the OAuth branding or not, but I wanted people to both be aware of the work and to start the conversation on it. I think there’s some good work that we can do here.

— Justin

On May 6, 2019, at 4:42 PM, Hans Zandbelt <[email-masked]<mailto:[email-masked]>> wrote:

OAuth 2.0 has its merits and will be around for the next 20 years or so; yet we're bumping into its limitations every day if not only for its complexity and the incomprehensibility for regular IT peeps that don't have the full historical background; support for transactions is obviously missing today; I'm in for simplifying things, collapsing request parameters, use cases, PCKE, POP etc. in a non-backwards compatible protocol and suggest to adopt something similar to what you propose to become OAuth 3.0 (there, I said it ;-))

Hans.

On Mon, May 6, 2019 at 8:44 PM Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:
In a vein related to Torsten’s recent thread and blog post, I’ve also been working on a proposal around Transactional OAuth. As many of you know, I wrote a blog post about the basic idea last fall, and now I’ve got something a bit more concrete online that people can poke around with. I’m calling it “XYZ” just to give it a name, and it’s online here:

https://oauth.xyz/

— Justin

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

--
[email-masked]<mailto:[email-masked]>
ZmartZone IAM - www.zmartzone.eu<http://www.zmartzone.eu/>

---

From: Justin Richer <[email-masked]>
Date: Wed, 15 May 2019 21:08:24 +0000

I’ve submitted my draft of XYZ as an ID:

https://tools.ietf.org/html/draft-richer-transactional-authz-00

— Justin

On May 6, 2019, at 3:43 PM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:

https://oauth.xyz/

— Justin