Subject: [GNAP] Gathering Consent and Authorization

From: Justin Richer <[email-masked]>
Date: Fri, 9 Apr 2021 08:28:13 -0400

We’ve recently had a lot of good discussion about the nature and role of the AS within GNAP, and the editors stated that we would be working on new text to incorporate this discussion. With that in mind, I wanted to bring everyone’s attention to a PR that makes some big changes to the core spec, though mostly in the description of how components work and less with the normative syntax of the protocol itself.

https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242 <https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242>

This rewrites the section that is currently “Interaction at the AS” to better describe the wider range of possibilities for the authorization process. Note that this PR hasn’t been tagged as “pending merge” by the editors yet, which means there’s not a review deadline in place yet, but since it’s such a big change we’d like to get it in somewhat soon. Please go read through the new text and help improve it!

Thank you,
 — Justin

---

From: Denis <[email-masked]>
Date: Fri, 9 Apr 2021 17:11:49 +0200

Hi  Justin,

"Gathering Consent"  is not solely related with a section that would be 
called “Interaction at the AS”.

For authorizing a method on an object, the RS (or more precisely the RO 
controlling that object) is wishing to obtain some privileges
(i.e. attributes types and /or rights ) inside an access token that may 
be issued by *one AS among several ASs*.

The privileges a RS is wishing to obtain should be proportionate to the 
method that is being requested on the object. This means that
in the first access to a RS, the client should advertise both the method 
and the object on which the method applies and then in its response,
the RS should indicate which choices are possible and the reason(s) 
behind each choice ("User Notice").

In general, it is possible to decompose the end-user choice into three 
consecutive choices:

    a) a first choice for selecting the AS,
    b) a second choice for selecting different privileges *types *(i.e.
    attributes types and /or rights types) for the selected AS,
    c) a third choice selecting different privileges *values *for the
    selected privileges types (i.e. attributes type values and /or
    rights types values)

If a RS is only trusting one AS, the first choice becomes a YES or NO 
question. The second choice must be based on information provided by the RS,
since only the RS is knowing the rational to request some set of 
privileges. In such a case , the dialogue with the end-user can be done 
either
*directly at the RS* or *locally at the client* using information 
provided by the RS. The third choice must be done at the AS.

If a RS is trusting more than one AS, the first and the second choices 
must be done before contacting an AS (see above), while the third choice
must be done at the AS.

Denis

PS. I have not yet read through the new text.

> We’ve recently had a lot of good discussion about the nature and role 
> of the AS within GNAP, and the editors stated that we would be working 
> on new text to incorporate this discussion. With that in mind, I 
> wanted to bring everyone’s attention to a PR that makes some big 
> changes to the core spec, though mostly in the description of how 
> components work and less with the normative syntax of the protocol 
> itself.
>
> https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242 
> <https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242>
>
> This rewrites the section that is currently “Interaction at the AS” to 
> better describe the wider range of possibilities for the authorization 
> process. Note that this PR hasn’t been tagged as “pending merge” by 
> the editors yet, which means there’s not a review deadline in place 
> yet, but since it’s such a big change we’d like to get it in somewhat 
> soon. Please go read through the new text and help improve it!
>
> Thank you,
>  — Justin
>

---

From: Fabien Imbault <[email-masked]>
Date: Fri, 9 Apr 2021 17:33:16 +0200

Hi,

Remember that for convenience, the PR generates an HTML draft, so you
should be able to read easily.
See
https://deploy-preview-242--gnap-core-protocol-editors-draft.netlify.app/

In particular section 4 is now called Determining Authorization and Consent.

Cheers
Fabien

On Fri, Apr 9, 2021 at 5:12 PM Denis <[email-masked]> wrote:

> (i.e. attributes types and /or rights ) inside an access token that may be
> issued by *one AS among several ASs*.
>
> the RS should indicate which choices are possible and the reason(s) behind
> each choice ("User Notice").
>
> selected privileges types (i.e. attributes type values and /or rights types
> values)
>
> We’ve recently had a lot of good discussion about the nature and role of
> the AS within GNAP, and the editors stated that we would be working on new
> text to incorporate this discussion. With that in mind, I wanted to bring
> everyone’s attention to a PR that makes some big changes to the core spec,
> though mostly in the description of how components work and less with the
> normative syntax of the protocol itself.
>
> process. Note that this PR hasn’t been tagged as “pending merge” by the
> editors yet, which means there’s not a review deadline in place yet, but
> since it’s such a big change we’d like to get it in somewhat soon. Please
> go read through the new text and help improve it!
>
> Thank you,
>  — Justin
>
>
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>