Subject: [OAUTH-WG] What are the OAuth design principles?

From: Eve Maler <[email-masked]>
Date: Mon, 22 Mar 2010 16:00:59 -0700

Since the discussion in the "OAuth after-party" seemed to warrant bringing it up, I mentioned the UMA design principles/requirements document.  You can find it here:

http://kantarainitiative.org/confluence/display/uma/UMA+Requirements

The discussion is around "Why can't Kerberos just be used for your use cases?"  The UMA principles might be able to inform how the OAuth WG makes its case for why Kerberos doesn't suffice.  (If we discover it does, hey, our work here is done. :-)

	Eve

Eve Maler
[email-masked]
http://www.xmlgrrl.com/blog

---

From: Anthony Nadalin <[email-masked]>
Date: Mon, 22 Mar 2010 23:58:27 +0000

My design principles would be the following as we already have protocols that solve many complex usecases  

1. Simple programming model
3. Reduce deployment barriers 
2. Limited or no client side code (works with a browser)
3. Replace username/password scenarios 
4. No client side key distribution nightmares    

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eve Maler
Sent: Monday, March 22, 2010 4:01 PM
To: OAuth WG
Subject: [OAUTH-WG] What are the OAuth design principles?

	Eve

Eve Maler
[email-masked]

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Leif Johansson <[email-masked]>
Date: Wed, 24 Mar 2010 18:32:44 +0100

> The discussion is around "Why can't Kerberos just be used for your use cases?"  The UMA principles might be able to inform how the OAuth WG makes its case for why Kerberos doesn't suffice.  (If we…

There are two threads here

- why Kerberos _as such_ does or does not work for the use-cases
- what experiences from 3rd party schemes such as Kerberos or STS are 
valuable for OAuth.

Being long-time Kerberos-fanboy I still say that one of those threads
are interesting and the other isn't.

I think its much more valuable to talk about how to distill experience
from Kerberos (etc) which are applicable to the design of OAuth.

	Cheers Leif