Subject: [OAUTH-WG] Meeting Minutes

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 3 Dec 2019 08:25:08 +0000

Here are the meeting minutes from the Singapore IETF meeting:
https://datatracker.ietf.org/meeting/106/materials/minutes-106-oauth-03

Tony was our scribe. Thanks!

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Brian Campbell <[email-masked]>
Date: Mon, 16 Dec 2019 09:26:28 -0700

With respect to the Pushed Authorization Requests (PAR) draft the minutes
do capture an individual comment that it's a "no brainer to adopt this
work" but as I recall there was also a hum to gauge the room's interest in
adoption, which was largely in favor of such. Of course, one hum in
Singapore isn't the final word but, following from that, I was
hoping/expecting to see a call for adoption go out to the mailing list?

On Tue, Dec 3, 2019 at 1:26 AM Hannes Tschofenig <[email-masked]>
wrote:

> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Justin Richer <[email-masked]>
Date: Mon, 16 Dec 2019 15:35:47 -0500

+1 to this. My take away was that PAR was pretty clear for adoption right now, RAR had interest but more question/debate. 

FWIW I’m in favor of both of them.

 — Justin

> On Dec 16, 2019, at 11:26 AM, Brian Campbell <bcampbell=[email-masked]> wrote:
> 
> With respect to the Pushed Authorization Requests (PAR) draft the minutes do capture an individual comment that it's a "no brainer to adopt this work" but as I recall there was also a hum to gauge the room's interest in adoption, which was largely in favor of such. Of course, one hum in Singapore isn't the final word but, following from that, I was hoping/expecting to see a call for adoption go out to the mailing list? 
> 
> On Tue, Dec 3, 2019 at 1:26 AM Hannes Tschofenig <[email-masked] <mailto:[email-masked]>> wrote:
> https://datatracker.ietf.org/meeting/106/materials/minutes-106-oauth-03 <https://datatracker.ietf.org/meeting/106/materials/minutes-106-oauth-03>
>  
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/oauth <https://www.ietf.org/mailman/listinfo/oauth>
> 
> CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________
> OAuth mailing list
> [email-masked]

---

From: "Richard Backman, Annabelle" <[email-masked]>
Date: Mon, 16 Dec 2019 21:56:42 +0000

+1 for a call for adoption on PAR.

I’d also like to see one for RAR; while there are questions that need to be resolved, there seems to be strong interest in this work and adoption means we can have those discussions within the WG where they belong.

–
Annabelle Richard Backman
AWS Identity

From: OAuth <[email-masked]> on behalf of Justin Richer <[email-masked]>
Date: Monday, December 16, 2019 at 12:36 PM
To: Brian Campbell <bcampbell=[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: Re: [OAUTH-WG] Meeting Minutes

 — Justin

On Dec 16, 2019, at 11:26 AM, Brian Campbell <bcampbell=[email-masked]<mailto:bcampbell=[email-masked]>> wrote:

On Tue, Dec 3, 2019 at 1:26 AM Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Here are the meeting minutes from the Singapore IETF meeting:
https://datatracker.ietf.org/meeting/106/materials/minutes-106-oauth-03

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited..  If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Rob Otto <[email-masked]>
Date: Mon, 16 Dec 2019 22:02:37 +0000

I’d support adoption of both PAR and RAR.

On Mon, 16 Dec 2019 at 21:57, Richard Backman, Annabelle <richanna=
[email-masked]> wrote:

> I’d also like to see one for RAR; while there are questions that need to
> be resolved, there seems to be strong interest in this work and adoption
> means we can have those discussions within the WG where they belong.
>
>
>
> –
>
> *From: *OAuth <[email-masked]> on behalf of Justin Richer <
> [email-masked]>
> *Date: *Monday, December 16, 2019 at 12:36 PM
> *To: *Brian Campbell <bcampbell=[email-masked]>
> *Cc: *"[email-masked]" <[email-masked]>
> *Subject: *Re: [OAUTH-WG] Meeting Minutes
>
>
>
> +1 to this. My take away was that PAR was pretty clear for adoption right
> now, RAR had interest but more question/debate.
>
>
>
> On Dec 16, 2019, at 11:26 AM, Brian Campbell <
> bcampbell=[email-masked]> wrote:
>
>
>
> On Tue, Dec 3, 2019 at 1:26 AM Hannes Tschofenig <
> [email-masked]> wrote:
>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited..
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*_______________________________________________
> OAuth mailing list
> [email-masked]
-- 
Rob Otto
EMEA Field CTO - Ping Identity
+44 777 135 6092

---

From: Dominick Baier <[email-masked]>
Date: Tue, 17 Dec 2019 02:43:06 -0500

———
Dominick Baier

On 16. December 2019 at 23:02:58, Rob Otto (
robotto=[email-masked]) wrote:

On Mon, 16 Dec 2019 at 21:57, Richard Backman, Annabelle <richanna=
[email-masked]> wrote:

> *From:* OAuth <[email-masked]> on behalf of Justin Richer <
> [email-masked]>
> *Date:* Monday, December 16, 2019 at 12:36 PM
> *To:* Brian Campbell <bcampbell=[email-masked]>
> *Cc:* "[email-masked]" <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Meeting Minutes
>
>
>
> * CONFIDENTIALITY NOTICE: This email may contain confidential and

* CONFIDENTIALITY NOTICE: This email may contain confidential and
privileged material for the sole use of the intended recipient(s). Any
review, use, distribution or disclosure by others is strictly prohibited..
If you have received this communication in error, please notify the sender
immediately by e-mail and delete the message and any file attachments from
your computer. Thank you.* _______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Steinar Noem <[email-masked]>
Date: Tue, 17 Dec 2019 08:53:20 +0100

I'd also like to see adoption for both PAR and RAR. We will actually start
to use the "authorization_details" parameter early next year.

tir. 17. des. 2019 kl. 08:43 skrev Dominick Baier <[email-masked]
>:

> your computer. Thank you.*

-- 
Vennlig hilsen

Steinar Noem
Partner Udelt AS
Systemutvikler

| [email-masked] | [email-masked]  | +47 955 21 620 | www.udelt.no |

---

From: David Waite <[email-masked]>
Date: Tue, 17 Dec 2019 01:28:21 -0700

+1 to adopting PAR.

For RAR I have a number of questions myself with the approach and with some of the ramifications. I’m most concerned with the coupling of business-specific presentation, process validation and workflow within the AS, but also with the mixing of single transactional approval into accesses token that is normally meant for longer-lived, coarser client authorizations.

To stick with the primary payment example - there are payment cases which model well for single resource authorization, such as a PayPal-style transaction where the client is also the recipient of funds. For other types of transactions, I would worry this may become primarily an AS-executed action rather than a client authorization.

Before the device flow and before CIBA, I’d probably try and make a case for not adopting it. The decoupling of the client from any user-agent that could ask for user authorization outside of OAuth has made an increase in scope (of scopes) a higher need - the current communication pipe between the client and user-agent is only defined in the scope of the actual OAuth grant processes.

-DW

> On Dec 16, 2019, at 9:26 AM, Brian Campbell <bcampbell=[email-masked]> wrote:
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sat, 21 Dec 2019 10:58:39 +0100

With respect to Rich Authorization Requests, the minutes state that a call for adoption will be sent to the list. When will this call for adoption being sent to the list?

> Am 03.12.2019 um 09:26 schrieb Hannes Tschofenig <[email-masked]>:
> 
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________
> OAuth mailing list
> [email-masked]

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 23 Dec 2019 15:56:54 +0000

During the vacation period few people pay attention to the list. I guess early 2020 would be useful.
If you manage to ping some folks to review the draft that would be great. Too few raised their hands in Singapore when we asked.

Happy holidays!

From: Torsten Lodderstedt <[email-masked]>
Sent: Saturday, December 21, 2019 10:59 AM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [OAUTH-WG] Meeting Minutes

Am 03.12.2019 um 09:26 schrieb Hannes Tschofenig <[email-masked]<mailto:[email-masked]>>:

---

From: Torsten Lodderstedt <[email-masked]>
Date: Mon, 23 Dec 2019 17:34:11 +0100

If I got you right you want to see more people reading the draft? 

6 non authors had read the draft in Singapore + more people already indicated their support for WG adoption in this thread. 

How many readers does it take to qualify for a call for adoption? 

> On 23. Dec 2019, at 16:56, Hannes Tschofenig <[email-masked]> wrote:
>