Subject: [GNAP] Design team

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 9 Oct 2020 18:55:13 -0400

Greetings!

The design team has now come to a close.  While there were too many issues to resolve to all design team member satisfaction, great effort was put in to describe decision points for the WG to ease and hopefully speed the working group process.  As such, I am requesting that the WG adopts this version (14 of XYZ) and works together to fully develop a single specification.

https://datatracker.ietf.org/doc/draft-richer-transactional-authz/

A tremendous thank you to each of the design team members for your hard work and walking the fine line of when to put a stake in the ground (that the WG can always change once adopted) and listing our options for decision points to ease the WG process.

Best regards,
Kathleen 

Sent from my mobile device

---

From: Justin Richer <[email-masked]>
Date: Sat, 10 Oct 2020 00:04:31 +0000

Thanks, Kathleen, and thanks to Dick, Mike, and Fabian for all their hard work and discussion as well. This draft contains aspects of XYZ and Xauth, and introduces some new elements and pieces as well. As you'll see, there are many identified issues and decisions to be made, but even then I believe it hangs together fairly cohesively already thanks to the good engineering effort and discussion that's gone in so far. 

Nothing in the document is final, of course. To me, this document represents a good starting point for working group discussion and decisions, +1 for its adoption. 

- Justin
________________________________________
From: TXAuth [[email-masked]] on behalf of Kathleen Moriarty [[email-masked]]
Sent: Friday, October 9, 2020 6:55 PM
To: [email-masked]
Subject: [GNAP] Design team

Greetings!

Best regards,
Kathleen

---

From: Dick Hardt <[email-masked]>
Date: Fri, 9 Oct 2020 17:25:23 -0700

Tl;dr: Given where we are in the WG, I am not opposed to the WG adopting
-14, but I propose someone other than Justin be the document editor.

I was on the design team to work on the goals set out by the chairs [1]:

"We expect the design team to decide on a solution outline that combines
the best of both proposals, and present this outline by Sep. 15"

Surprisingly, Kathleen convened the design team with her recommendation to
start with the XYZ document with Justin as editor, and add in the diagrams
from XAuth. The rest of the design team had an opportunity to express their
concerns and Justin edited the document. In other words, I had to convince
Justin to change the document, rather than the design team comparing and
contrasting the proposals and selecting the best parts. I expressed my
concerns with our AD, and decided to continue participating in the design
team. We did make some progress on a number of issues thanks to the hard
work of Fabien, Justin, and Mike -- but many issues have been punted to the
WG.

Justin has poured tons of energy into this project, and to his credit he
was a good editor at times, but there are areas where he was unwilling to
deviate from his vision.

I am concerned about a repeat of what happened in OAuth 2.0: Erin had the
pen and had strong views that often were not aligned with the rest of the
WG. A good example was Erin's distaste for bearer tokens. He factored that
out of the core document, which we are now adding back in with OAuth 2.1.
Anyone that participated in the WG saw the issues this had.

I'm not suggesting that Justin is Erin, but I think a more neutral editor
of the core document will allow us to make progress more quickly.

/Dick

[1]
https://mailarchive.ietf.org/arch/msg/txauth/By7tDkJBxhmHbP7vKwubC9eW38I/
ᐧ

On Fri, Oct 9, 2020 at 5:04 PM Justin Richer <[email-masked]> wrote:

> Thanks, Kathleen, and thanks to Dick, Mike, and Fabian for all their hard
> work and discussion as well. This draft contains aspects of XYZ and Xauth,
> and introduces some new elements and pieces as well. As you'll see, there
> are many identified issues and decisions to be made, but even then I
> believe it hangs together fairly cohesively already thanks to the good
> engineering effort and discussion that's gone in so far.
>
> Nothing in the document is final, of course. To me, this document
> represents a good starting point for working group discussion and
> decisions, +1 for its adoption.
>
> - Justin
> The design team has now come to a close.  While there were too many issues
> to resolve to all design team member satisfaction, great effort was put in
> to describe decision points for the WG to ease and hopefully speed the
> working group process.  As such, I am requesting that the WG adopts this
> version (14 of XYZ) and works together to fully develop a single
> specification.
>
> A tremendous thank you to each of the design team members for your hard
> work and walking the fine line of when to put a stake in the ground (that
> the WG can always change once adopted) and listing our options for decision
> points to ease the WG process.
>
> Best regards,
> Kathleen
>
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 9 Oct 2020 21:34:47 -0400

My take is very different, Dick.  I am starting a 2 week vacation and will not be spending it arguing with you on the list.

Multiple reviews pointed to Justin’s document as a better starting point, not just mine.  Your use case cases can be met and some of what you were asking for did not follow RESTful design patterns.  They really don’t map to a future protocol well.  You may need to write extension documents, but your goals can be met.

Many calls were difficult as displayed in your message.  Justin did a great job handling the weekly tension and ensuring options were included for WG discussion when agreement was not met.  He’s completely amenable to following the WG and chairs decisions.  His document was also easier to follow and aligned better with numerous IETF documents.  Please do keep Justin on as an editor. As you can see from the draft, there are many areas where WG input on decision points are requested.

Best regards,
Kathleen 

> On Oct 9, 2020, at 8:26 PM, Dick Hardt <[email-masked]> wrote:
> 
> 
> Tl;dr: Given where we are in the WG, I am not opposed to the WG adopting -14, but I propose someone other than Justin be the document editor. 
> 
> "We expect the design team to decide on a solution outline that combines the best of both proposals, and present this outline by Sep. 15"
> 
> Surprisingly, Kathleen convened the design team with her recommendation to start with the XYZ document with Justin as editor, and add in the diagrams from XAuth. The rest of the design team had an opportunity to express their concerns and Justin edited the document. In other words, I had to convince Justin to change the document, rather than the design team comparing and contrasting the proposals and selecting the best parts. I expressed my concerns with our AD, and decided to continue participating in the design team. We did make some progress on a number of issues thanks to the hard work of Fabien, Justin, and Mike -- but many issues have been punted to the WG. 
> 
> Justin has poured tons of energy into this project, and to his credit he was a good editor at times, but there are areas where he was unwilling to deviate from his vision. 
> 
> I am concerned about a repeat of what happened in OAuth 2.0: Erin had the pen and had strong views that often were not aligned with the rest of the WG. A good example was Erin's distaste for bearer tokens. He factored that out of the core document, which we are now adding back in with OAuth 2.1. Anyone that participated in the WG saw the issues this had.
> 
> I'm not suggesting that Justin is Erin, but I think a more neutral editor of the core document will allow us to make progress more quickly. 
> 
> /Dick
> 
> [1] https://mailarchive.ietf.org/arch/msg/txauth/By7tDkJBxhmHbP7vKwubC9eW38I/
> ᐧ
>

---

From: Fabien Imbault <[email-masked]>
Date: Sat, 10 Oct 2020 04:14:45 +0200

Hi there,

+1 for adopting v14 as a basis for the GNAP WG.

I think really important to have one single document to get everyone
started, and not be stuck on a xyz vs xauth comparison. Instead we now have
a relatively consistent starting point, which is neither xyz nor xauth, for
everyone to step in.

The draft is still inspired by xyz at its core, but a lot of work has been
put into taking the concerns raised in xauth (Dick did raise many issues
into the original document, and made a great job), and others. As anyone
will be able to see into the change logs.

What's important is that editorial notes provide a good summary of the
design choices we need to make.
I can anticipate that some of you will raise other items discussed on the
mailing list, such as privacy for instance. There was consensus on the fact
that it needs to be one of the goals (amongst others) but our core focus
during the work carried out in the small group was to focus on dissenting
opinions about what the starting document should contain. It's not meant to
be perfect (yeah, goal achieved :-)).

I can attest Justin put a lot of hard work in taking into account the
feedbacks and criticisms, and it's quite impressive to still have a fairly
consistent document after so many changes in a short period of time.

Of course neither of us had all of its wishes come true :-) Dick probably
feels some issues he raised are not fully incorporated, because some are
fundamentally different design choices. Again Dick raised very useful
items, some of which made it through, others are only integrated as notes.
At times the tension was palpable and sometimes Kathleen had to remind
everyone to cool down (thanks for that!). And we see some of that into
Dick's request today. I regret a bit that this might hinder the positive
outcome of the work.

All items were on the table. We made a fairly thorough comparison of the
approaches, which led to many parts being rewritten. Justin was quite clear
when he disagreed (it's explicit in the notes) but still captured with
integrity the essence of the tradeoffs, with an open mind.

Of course there's a specific power in holding the pen. I think Justin is
aware of what the role implies. Of course it's sometimes hard to not be too
opinionated, while still being able to say no when required.

Probably the chairs could step in to clarify escalation rules to avoid the
risk mentioned by Dick, in case it ever materializes. No one is perfect.
But so far, Justin's mandate has not transformed into a benevolent
dictatorship, but more a balanced guardianship. As such he keeps my
continued support into the editor's role.

Cheers
Fabien

Le sam. 10 oct. 2020 à 02:26, Dick Hardt <[email-masked]> a écrit :

>> The design team has now come to a close.  While there were too many
>> issues to resolve to all design team member satisfaction, great effort was
>> put in to describe decision points for the WG to ease and hopefully speed
>> the working group process.  As such, I am requesting that the WG adopts
>> this version (14 of XYZ) and works together to fully develop a single
>> specification.
>>

---

From: Dmitri Zagidulin <[email-masked]>
Date: Sat, 10 Oct 2020 13:44:20 -0400

Big congratulations to the design team. This looks like it was a titanic
effort, and the resulting draft looks great.

Thank you all for your hard work!

On Fri, Oct 9, 2020 at 10:15 PM Fabien Imbault <[email-masked]>
wrote:

>> Surprisingly, Kathleen convened the design team with her recommendation
>> to start with the XYZ document with Justin as editor, and add in the
>> diagrams from XAuth. The rest of the design team had an opportunity to
>> express their concerns and Justin edited the document. In other words, I
>> had to convince Justin to change the document, rather than the design team
>> comparing and contrasting the proposals and selecting the best parts. I
>> expressed my concerns with our AD, and decided to continue participating in
>> the design team. We did make some progress on a number of issues thanks to
>> the hard work of Fabien, Justin, and Mike -- but many issues have been
>> punted to the WG.
>>
>>> Thanks, Kathleen, and thanks to Dick, Mike, and Fabian for all their
>>> hard work and discussion as well. This draft contains aspects of XYZ and
>>> Xauth, and introduces some new elements and pieces as well. As you'll see,
>>> there are many identified issues and decisions to be made, but even then I

---

From: Dick Hardt <[email-masked]>
Date: Mon, 19 Oct 2020 20:26:18 -0700

I don't see how your take is different in the process you chose to take, vs
the process I had suggested in the WG meeting, and the chairs had set as
the goals of the design team. Despite the WG not adopting your
recommendation to start with XYZ, you chose to ignore the WG and chairs and
start with the XYZ document.

wrt. RESTful design patterns, that was a design pattern that XAuth
introduced and that XYZ has adopted. The one comment about a suggestion I
made that was not RESTful -- I was asking for the parameters in JWS signing
to be moved from the JWS header to the JWS payload -- my suggestion was not
making it any less RESTful than it already was. Inaccurate representations
like this contributed to the tension in the meetings.

One of your criticisms of XAuth was the use of "non standard IETF language"
such as "sequence" -- a term that is now used numerous times in the draft.

I hope you had a RESTful vacation!

On Fri, Oct 9, 2020 at 6:34 PM Kathleen Moriarty <
[email-masked]> wrote:

>
> My take is very different, Dick.  I am starting a 2 week vacation and will
> not be spending it arguing with you on the list.
>
> Multiple reviews pointed to Justin’s document as a better starting point,
> not just mine.  Your use case cases can be met and some of what you were
> asking for did not follow RESTful design patterns.  They really don’t map
> to a future protocol well.  You may need to write extension documents, but
> your goals can be met.
>
> Many calls were difficult as displayed in your message.  Justin did a
> great job handling the weekly tension and ensuring options were included
> for WG discussion when agreement was not met.  He’s completely amenable to
> following the WG and chairs decisions.  His document was also easier to
> follow and aligned better with numerous IETF documents.  Please do keep
> Justin on as an editor. As you can see from the draft, there are many areas
> where WG input on decision points are requested.
>
> Best regards,
> Kathleen
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 20 Oct 2020 06:12:57 -0400

Your interpretation of events is in contrast to mine.  I’m not going to argue further with you as there’s no point unless you get your way.  There were 2 detailed reviews from the design team that preferred Justin’s document as a starting point, none with yours.  His was preferred for several reasons including ease of understanding and aligned better with IETF protocol specs for cross area review.

Best regards,
Kathleen 

> On Oct 19, 2020, at 11:26 PM, Dick Hardt <[email-masked]> wrote:
> 
> 
> I don't see how your take is different in the process you chose to take, vs the process I had suggested in the WG meeting, and the chairs had set as the goals of the design team. Despite the WG not adopting your recommendation to start with XYZ, you chose to ignore the WG and chairs and start with the XYZ document.
> 
> wrt. RESTful design patterns, that was a design pattern that XAuth introduced and that XYZ has adopted. The one comment about a suggestion I made that was not RESTful -- I was asking for the parameters in JWS signing to be moved from the JWS header to the JWS payload -- my suggestion was not making it any less RESTful than it already was. Inaccurate representations like this contributed to the tension in the meetings.
> 
> One of your criticisms of XAuth was the use of "non standard IETF language" such as "sequence" -- a term that is now used numerous times in the draft. 
> 
>> On Fri, Oct 9, 2020 at 6:34 PM Kathleen Moriarty <[email-masked]> wrote:
>>

---

From: Dick Hardt <[email-masked]>
Date: Tue, 20 Oct 2020 10:06:15 -0700

Kathleeen, you keep talking about why we started with XYZ, I'm stating that
the goal of the design team was NOT to choose a starting document, but to
select the best ideas and create an outline.

> the best of both proposals, and present this outline by Sep. 15"[1]
>
> [1]

I find your comment on me "getting my way" is dismissive of having a
civil conversation.

ᐧ

On Tue, Oct 20, 2020 at 3:16 AM Kathleen Moriarty <
[email-masked]> wrote:

> Your interpretation of events is in contrast to mine.  I’m not going to
> argue further with you as there’s no point unless you get your way.  There
> were 2 detailed reviews from the design team that preferred Justin’s
> document as a starting point, none with yours.  His was preferred for
> several reasons including ease of understanding and aligned better with
> IETF protocol specs for cross area review.
>
> Best regards,
> Kathleen
>
> I don't see how your take is different in the process you chose to take,
> vs the process I had suggested in the WG meeting, and the chairs had set as
> One of your criticisms of XAuth was the use of "non standard IETF
> language" such as "sequence" -- a term that is now used numerous times in
> the draft.
>
>> My take is very different, Dick.  I am starting a 2 week vacation and
>> will not be spending it arguing with you on the list.
>>