Subject: [OAUTH-WG] Call for adoption - OAuth 2.1 document

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 15 Jul 2020 13:41:30 -0400

All,

This is a *call for adoption* for the following *OAuth 2.1* document as a
WG document:
https://www.ietf.org/id/draft-parecki-oauth-v2-1-03.html

Please, provide your feedback on the mailing list by *July 29th.*

Regards,
 Rifaat & Hannes

---

From: Dick Hardt <[email-masked]>
Date: Wed, 15 Jul 2020 10:54:38 -0700

+1

On Wed, Jul 15, 2020 at 10:42 AM Rifaat Shekh-Yusef <[email-masked]>
wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Warren Parad <[email-masked]>
Date: Wed, 15 Jul 2020 20:57:18 +0200

I only recently joined this WG DL, so maybe this was already discussed by I
have two things I'm confused/curious about:

1. Can we avoid using (1, 2, 3) on the left side of the diagram to
describe, I'm not even sure what they are supposed to represent, not to
mention the RO in the diagram doesn't really provide value (for me)
relevant to the code grant flow. It's confusing to see these numerical
identifiers twice in the same picture. But maybe there is something hidden
in this that I'm missing, still 3a and 3b could be used to identify
different legs of the same code path.

2. It seems recently more and more common to pass the access_token to some
RS via a cookie, yet 7.2.1 says it defines two methods. I think we need
some RFC2119
<https://www.ietf.org/id/draft-parecki-oauth-v2-1-03.html#RFC2119> keywords
here, to suggest that either SHOULD use one of these two, or MUST. And then
optionally state whether or not we recommend or reject the use of cookies
as a place for access tokens. It's also possible that the language threw me
off, because would an access token in a cookie be a bearer token, but no
matter, if I'm having this thought, then surely others have it as well,
right?

*Warren Parad*
Secure your user data and complete your authorization architecture.
Implement Authress <https://bit.ly/37SSO1p>.
<https://rhosys.ch>

On Wed, Jul 15, 2020 at 7:55 PM Dick Hardt <[email-masked]> wrote:

> +1
>
> On Wed, Jul 15, 2020 at 10:42 AM Rifaat Shekh-Yusef <
> [email-masked]> wrote:
>
>> All,
>>
>> This is a *call for adoption* for the following *OAuth 2.1* document as
>> a WG document:

---

From: Aaron Parecki <[email-masked]>
Date: Wed, 15 Jul 2020 12:02:02 -0700

Just to clarify, this thread is a call for adoption, not meant to discuss
the details of this particular draft.

Any issues with the draft can be raised as new threads. But right now, the
question posed to the list is whether the group thinks this document should
be adopted as a working group item.

Oh, and +1 from me :-)

Aaron Parecki
https://aaronparecki.com

On Wed, Jul 15, 2020 at 11:57 AM Warren Parad <[email-masked]> wrote:

> I only recently joined this WG DL, so maybe this was already discussed by
> I have two things I'm confused/curious about:
>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 15 Jul 2020 15:13:56 -0400

Warren,

Please, start a separate thread for this issue.

Regards,
 Rifaat

---

From: Neil Madden <[email-masked]>
Date: Wed, 15 Jul 2020 20:32:24 +0100

I support adoption. 

> On 15 Jul 2020, at 18:42, Rifaat Shekh-Yusef <[email-masked]> wrote:
> 
> 
> All,
> 
> This is a call for adoption for the following OAuth 2.1 document as a WG document:
> Please, provide your feedback on the mailing list by July 29th.
> 
> Regards,
>  Rifaat & Hannes
>

---

From: John Bradley <[email-masked]>
Date: Wed, 15 Jul 2020 15:37:39 -0400

I support addoption

On 7/15/2020 3:32 PM, Neil Madden wrote:
>> This is a *call for adoption* for the following *OAuth 2.1* document
>> as a WG document:

---

From: Torsten Lodderstedt <[email-masked]>
Date: Wed, 15 Jul 2020 21:40:18 +0200

+1

> On 15. Jul 2020, at 21:37, John Bradley <[email-masked]> wrote:
> 
> I support addoption
>

---

From: Falk Andreas <[email-masked]>
Date: Wed, 15 Jul 2020 20:31:16 +0000

+1

I support adoption

--

Andreas Falk
Managing Consultant / Practice Lead Agile Security

[Novatec Logo]<https://www.novatec-gmbh.de/>

T. +49 711 22040-700<tel:+49-711-22040-700> ∙ M. +49 151 46146778<tel:+49-151-46146778>
[email-masked]<mailto:[email-masked]> ⋅ www.novatec-gmbh.de<https://www.novatec-gmbh.de/>

Novatec Consulting GmbH
Dieselstraße 18/1, D-70771 Leinfelden-Echterdingen

Folgen Sie uns auf Facebook<https://www.facebook.com/novatec.holding/>, LinkedIn<https://de.linkedin.com/company/novatec-gmbh>, Twitter<https://twitter.com/novatecgmbh>, XING<https://www.xing.com/companies/novatecgmbh> oder auf unserem Blog<https://blog.novatec-gmbh.de/>

Sitz: Leinfelden-Echterdingen ∙ Handelsregister: Amtsgericht Stuttgart ∙ HRB 739078
Geschäftsführer: Stefan Bleicher, Hans-Dieter Brenner, Konrad Pfeilsticker, Michael Schuchart

________________________________
Von: OAuth <[email-masked]> im Auftrag von Torsten Lodderstedt <torsten=[email-masked]>
Gesendet: Mittwoch, 15. Juli 2020 21:40
An: John Bradley <[email-masked]>
Cc: [email-masked] <[email-masked]>
Betreff: Re: [OAUTH-WG] Call for adoption - OAuth 2.1 document

+1

---

From: Hans Zandbelt <[email-masked]>
Date: Wed, 15 Jul 2020 22:39:37 +0200

+1

Hans.

-- 
[email-masked]
ZmartZone IAM - www.zmartzone.eu

---

From: Sascha Preibisch <[email-masked]>
Date: Wed, 15 Jul 2020 15:53:58 -0700

+1

On Wed, 15 Jul 2020 at 13:40, Hans Zandbelt <[email-masked]> wrote:
>
> +1
>
> Hans.
>
> On Wed, Jul 15, 2020 at 7:43 PM Rifaat Shekh-Yusef <[email-masked]> wrote:
>>
>> All,
>>

---

From: <[email-masked]>
Date: Wed, 15 Jul 2020 16:36:59 -0700

+1

From: OAuth <[email-masked]> On Behalf Of Dick Hardt
Sent: Wednesday, July 15, 2020 10:55 AM
To: Rifaat Shekh-Yusef <[email-masked]>
Cc: oauth <[email-masked]>
Subject: Re: [OAUTH-WG] Call for adoption - OAuth 2.1 document

+1

On Wed, Jul 15, 2020 at 10:42 AM Rifaat Shekh-Yusef <[email-masked] <mailto:[email-masked]> > wrote:

All,

Regards,

 Rifaat & Hannes

_______________________________________________
OAuth mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/oauth

---

From: William Denniss <[email-masked]>
Date: Wed, 15 Jul 2020 16:53:37 -0700

I support adoption.

On Wed, Jul 15, 2020 at 4:37 PM <vittorio.bertocci=
[email-masked]> wrote:

> +1
>
>
>
> *From:* OAuth <[email-masked]> *On Behalf Of *Dick Hardt
> *Sent:* Wednesday, July 15, 2020 10:55 AM
> *To:* Rifaat Shekh-Yusef <[email-masked]>
> *Cc:* oauth <[email-masked]>
> *Subject:* Re: [OAUTH-WG] Call for adoption - OAuth 2.1 document
>
>
>
> +1
>
>
>

---

From: Dominick Baier <[email-masked]>
Date: Wed, 15 Jul 2020 23:08:49 -0700

I support adoption

———
Dominick Baier

On 16. July 2020 at 01:54:08, William Denniss (
wdenniss=[email-masked]) wrote:

I support adoption.

---

From: Jim Willeke <[email-masked]>
Date: Thu, 16 Jul 2020 03:32:36 -0400

I support addoption
--
-jim
Jim Willeke

---

From: Daniel Fett <[email-masked]>
Date: Thu, 16 Jul 2020 09:42:16 +0200

+1

-- 
https://danielfett.de

---

From: Dave Tonge <[email-masked]>
Date: Thu, 16 Jul 2020 10:08:51 +0200

+1

-- 
Dave Tonge
CTO
<http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A>
Moneyhub Financial Technology, 5th Floor, 10 Temple Back, Bristol, BS1 6FL
t: +44 (0)117 280 5120

Moneyhub Enterprise is a trading style of Moneyhub Financial Technology
Limited which is authorised and regulated by the Financial Conduct
Authority ("FCA"). Moneyhub Financial Technology is entered on the
Financial Services Register (FRN 809360) at fca.org.uk/register.
Moneyhub Financial
Technology is registered in England & Wales, company registration number
06909772 .
Moneyhub Financial Technology Limited 2018 ©

DISCLAIMER: This email (including any attachments) is subject to copyright,
and the information in it is confidential. Use of this email or of any
information in it other than by the addressee is unauthorised and unlawful.
Whilst reasonable efforts are made to ensure that any attachments are
virus-free, it is the recipient's sole responsibility to scan all
attachments for viruses. All calls and emails to and from this company may
be monitored and recorded for legitimate purposes relating to this
company's business. Any opinions expressed in this email (or in any
attachments) are those of the author and do not necessarily represent the
opinions of Moneyhub Financial Technology Limited or of any other group
company.

-- 

Moneyhub Enterprise is a trading style of Moneyhub Financial Technology 
Limited which is authorised and regulated by the Financial Conduct 
Authority ("FCA"). Moneyhub Financial Technology is entered on the 
Financial Services Register (FRN 809360) at https://register.fca.org.uk/ 
<https://register.fca.org.uk/>. Moneyhub Financial Technology is registered 
in England & Wales, company registration number 06909772. Moneyhub 
Financial Technology Limited 2020 © Moneyhub Enterprise, Regus Building, 
Temple Quay, 1 Friary, Bristol, BS1 6EA. 

DISCLAIMER: This email 
(including any attachments) is subject to copyright, and the information in 
it is confidential. Use of this email or of any information in it other 
than by the addressee is unauthorised and unlawful. Whilst reasonable 
efforts are made to ensure that any attachments are virus-free, it is the 
recipient's sole responsibility to scan all attachments for viruses. All 
calls and emails to and from this company may be monitored and recorded for 
legitimate purposes relating to this company's business. Any opinions 
expressed in this email (or in any attachments) are those of the author and 
do not necessarily represent the opinions of Moneyhub Financial Technology 
Limited or of any other group company.

---

From: Vladimir Dzhuvinov <[email-masked]>
Date: Fri, 17 Jul 2020 09:57:24 +0300

+1

Vladimir

On 15/07/2020 20:54, Dick Hardt wrote:
> +1
>
> On Wed, Jul 15, 2020 at 10:42 AM Rifaat Shekh-Yusef
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     All,
>
>     This is a *call for adoption* for the following *OAuth 2.1*
>     document as a WG document:

---

From: Nat Sakimura <[email-masked]>
Date: Fri, 17 Jul 2020 22:29:11 +0900

+1

-- 
Nat Sakimura (=nat)
Chairman, OpenID Foundation
http://nat.sakimura.org/
@_nat_en

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Thu, 30 Jul 2020 07:49:24 -0400

All,

This concludes our call for adoption for this document.
The WG has decided to adopt this draft as a WG document.

*Authors,*

Feel free to submit a WG version of the document.

Regards,
 Rifaat

On Fri, Jul 17, 2020 at 9:29 AM Nat Sakimura <[email-masked]> wrote:

> +1
>
> On Fri, Jul 17, 2020 at 3:57 PM Vladimir Dzhuvinov <
> [email-masked]> wrote:
>
>> +1
>>
>> Vladimir

---

From: Sascha Preibisch <[email-masked]>
Date: Thu, 30 Jul 2020 08:29:53 -0700

+1

On Thu, 16 Jul 2020 at 23:57, Vladimir Dzhuvinov
<[email-masked]> wrote:
> On Wed, Jul 15, 2020 at 10:42 AM Rifaat Shekh-Yusef <[email-masked]> wrote:
>>
>> All,
>>