Subject: [OAUTH-WG] Rechartering

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 11 Sep 2010 19:59:53 -0400

Hi all,

at the Washington Internet Identity Workshop we had the chance to chat 
about OAuth. Given the progress on the main specification we should 
discuss WG re-chartering.

The following items had been proposed at the meeting:

* Messaging Signing
Example: http://www.ietf.org/mail-archive/web/oauth/current/msg04250.html

* User Experience Extensions
Example: http://datatracker.ietf.org/doc/draft-recordon-oauth-v2-ux/

* Artifact Binding
Example: http://datatracker.ietf.org/doc/draft-sakimura-oauth-requrl/

* SAML for OAuth
Example: http://datatracker.ietf.org/doc/draft-campbell-oauth-saml/

* Recommendations of commonly used Scope values
No draft available (to my knowledge)

* Dynamic Client Registration
Example: http://www.ietf.org/id/draft-oauth-dyn-reg-v1-00.txt

I am interested to hear
a) what items are important for you; we cannot work on everything at the 
same time.
b) what items are you willing to co-author (requires a hard time commitment)
c) what items are you willing to review
d) whether we should consider other items?

Btw, to have your work considered you have to submit an IETF draft. 
Please use the Web tool to upload it:
https://datatracker.ietf.org/idst/upload.cgi
Also use the following filename convention:
draft-[author last name]-oauth-[some short name]-[version#].txt

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 11 Sep 2010 20:15:29 -0400

I forgot an item already, namely 'identity management using OAuth' in 
the style of OpenID Connect.

At IIW we also had a chat about an implementers guide and 
interoperability tests. The idea of the implementers guide is create a 
living document that captures implementation experience with different 
programming languages and development frameworks. It was also expected 
that implementers will bundle different profiles and different 
extensions in their implementation and it would be useful to describe 
their experience.

In any case, I think both items are important.

Ciao
Hannes

On 11.09.2010 19:59, Hannes Tschofenig wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: David Recordon <[email-masked]>
Date: Sat, 11 Sep 2010 18:10:02 -0700

I'd like to see us finish Core before considering re-chartering. :)

But to your original question. I'm interested in the UX extension (said I'd
edit), device flow (said I'd edit), and the OpenID Connect work which
encompasses dynamic registration and likely artifact binding (also editing
but outside of the IETF).

On Sat, Sep 11, 2010 at 5:15 PM, Hannes Tschofenig <
[email-masked]> wrote:

> I forgot an item already, namely 'identity management using OAuth' in the
> style of OpenID Connect.
>
> At IIW we also had a chat about an implementers guide and interoperability
> tests. The idea of the implementers guide is create a living document that
> captures implementation experience with different programming languages and
> development frameworks. It was also expected that implementers will bundle
> different profiles and different extensions in their implementation and it
> would be useful to describe their experience.
>

---

From: Torsten Lodderstedt <[email-masked]>
Date: Sun, 12 Sep 2010 08:40:43 +0200

Hannes,

what about discovery?

"Recommendations of commonly used Scope values" sounds to weak from my 
point of view. I would rather suggest to work towards a clear definition 
of scope syntax and semantics, including resource server identification.

Please note, I submitted a I-D on token revocation 
(https://datatracker.ietf.org/doc/draft-lodderstedt-oauth-revocation/) I 
would like to become a WG item.

regards,
Torsten.

Am 12.09.2010 02:15, schrieb Hannes Tschofenig:
>> Example: 
>> http://www.ietf.org/mail-archive/web/oauth/current/msg04250.html
>>

---

From: Christian Scholz <[email-masked]>
Date: Mon, 13 Sep 2010 16:31:19 +0200

Hi!

2010/9/12 David Recordon <[email-masked]>

> but outside of the IETF).

As we submitted the draft about dynamic registration I am wondering if we
can somehow join our two. Is http://openidconnect.com/ still recent?
We (coming from UMA) had some additional requirements like also sending some
metadata information from the client to the server (as you'd normally do
with manual registration). We also would probably prefer having a separate
spec we can point to for registration (probably the same for discovery).

best regards,

Christian

-- 
Christian Scholz, COM.lounge GmbH, tel. +49 241 400 730 0,
http://comlounge.net
Blog: http://mrtopf.de/blog, Twitter: http://twitter.com/mrtopf

Podcasts:
Der OpenWeb-Podcast (http://openwebpodcast.de)
Data Without Borders (http://datawithoutborders.net)
Politisches: http://politfunk.de/

---

From: Thomas Hardjono <[email-masked]>
Date: Mon, 13 Sep 2010 14:24:02 -0400

Hannes,

I strongly believe that SAML support in Outh2.0 and "SAML-interoperability" is crucial in getting Oauth accepted and deployed in high-assurance (high-value) environments (eg. government, financials).

As such, if its ok with Brian, I would be willing to either co-author or review the SAML-related drafts.

ps. Apologies for stating the obvious, but I think the new charter/recharter should define clearly what is expected as deliverable(s) from the OAUTH WG in regards to SAML support.

Thanks.

/thomas/

__________________________

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Hannes Tschofenig
> Sent: Saturday, September 11, 2010 8:00 PM
> To: [email-masked]
> Subject: [OAUTH-WG] Rechartering
> 
> Hi all,
> 
> * Recommendations of commonly used Scope values No draft available (to
> my knowledge)
> 
> a) what items are important for you; we cannot work on everything at
> the same time.

---

From: Brian Campbell <[email-masked]>
Date: Mon, 13 Sep 2010 12:59:07 -0600

Thanks Thomas,

With respect to
https://datatracker.ietf.org/doc/draft-campbell-oauth-saml/, I'm
planning on updating it to come inline with draft -11 when it's
published as well as a couple other updates related to subject conf
and subject that have been discussed on this list.  As it stands, I'm
fine as author/editor of that and can always benefit from review.
There may well be other SAML related work coming soon, however, that
might be in need of author(s).

Thanks,
Brian

---

From: Igor Faynberg <[email-masked]>
Date: Tue, 14 Sep 2010 05:41:43 -0400

Hannes,

Many thanks for putting this together.

First, I strongly believe that the work that had already been identified 
important and had started needs to be finished, and to this end I 
consider the item that Torsten had brought forth, on *token revocation*, 
to be of the highest priority. We have had a useful and comprehensive 
discussion on the list, with quite democratic "vote" for options, and 
Torsten has a draft. (Note that the options I "voted" for were not 
accepted, but I am very happy with the process, and I will review the 
drafts--and contribute to it whenever needed.) Again, to me the this is 
a single most important item that needs to be completed, and I believe 
that it can be completed fairly quickly.

Second, I am interested in the SAML interworking item. This will help 
with moving OAuth into enterprise and possibly telecom, too. Again, I 
plan to review and comment--and contribute, if required--on this item.

Third, I think the implementers guide is  absolutely essential. 
(Interestingly enough, the discussion of white spaces vs. commas in 
yesterday's thread has effectively started this work.) In my opinion, 
this item must be carried in parallel with others. I wonder if this 
should be tied up with use cases. The use cases drive the protocol 
definition and then effectively become the testing tool for the 
protocol. Thus, for every use case, the guide could show an example 
implementation.

Fourth, of course, I am interested in "identity management using OAuth."

This is not to say that I am not interested in the rest of the items. (I 
am, and I could have listed them as the fifth item.) This is only my 
personal view on priorities.

Igor

---

From: Justin Richer <[email-masked]>
Date: Tue, 14 Sep 2010 10:46:36 -0400

> protocol. Thus, for every use case, the guide could show an example 

This is what I'd had in mind when I brought up the implementers guide. I
think we're seeing some common collections of stuff, profiles based on
real use cases. So a person saying "I want to build a PR server that
supports the webserver grant profile and the display extension", or
someone saying "I want to build a client for the Facebook collection of
stuff" will have a document that tells them exactly what to do at each
step. The spec itself splits things out into their normative places, but
someone building a component is going to want to just know what
arguments to put on each request.

 -- Justin

---

From: Mark Mcgloin <[email-masked]>
Date: Tue, 14 Sep 2010 16:18:43 +0100

What about Security Considerations. I know some individuals have worked on
it in the past - does it need a WG to complete

Mark McGloin

Hannes Tschofenig <[email-masked]>
Sent by: [email-masked]

12/09/2010 00:59

Hi all,

* Messaging Signing

* Artifact Binding

* SAML for OAuth

I am interested to hear
a) what items are important for you; we cannot work on everything at the
same time.
b) what items are you willing to co-author (requires a hard time
commitment)
c) what items are you willing to review
d) whether we should consider other items?

Ciao
Hannes

---

From: Torsten Lodderstedt <[email-masked]>
Date: Tue, 14 Sep 2010 18:01:29 +0200

I plan to work on that aspect. Do you (or someone else) want to contribute?

regards,
Torsten.

---

From: Eve Maler <[email-masked]>
Date: Tue, 14 Sep 2010 18:29:34 -0700

Dynamic authz server discovery and client registration would be needed in OAuth-based identity management.  But I would submit that they're needed even apart from it (since I've got that need), and so should be specified modularly, with the identity management piece pointing to it (if it wants to).

I've gotten strong interest in taking forward the dynamic client reg I-D as a work item from my co-authors and also some others who need to solve for native-app flows. So we (with Maciej Machulak as ringleader) can speak up for discovery/registration if that suits the group. (I'm not sure if discovery should be a separate module; I'm inclined to think it should be all together.)

	Eve

On 13 Sep 2010, at 7:31 AM, Christian Scholz wrote:

> But to your original question. I'm interested in the UX extension (said I'd edit), device flow (said I'd edit), and the OpenID Connect work which encompasses dynamic registration and likely artifact binding (also editing but outside of the IETF).
> 
> As we submitted the draft about dynamic registration I am wondering if we can somehow join our two. Is http://openidconnect.com/ still recent? 
> We (coming from UMA) had some additional requirements like also sending some metadata information from the client to the server (as you'd normally do with manual registration). We also would probably prefer having a separate spec we can point to for registration (probably the same for discovery).
> 
> best regards,
> 
> Christian
> 
> -- 
> Christian Scholz, COM.lounge GmbH, tel. +49 241 400 730 0, http://comlounge.net

Eve Maler                                  http://www.xmlgrrl.com/blog
+1 425 345 6756                         http://www.twitter.com/xmlgrrl

---

From: Eliot Lear <[email-masked]>
Date: Wed, 15 Sep 2010 07:41:10 +0200

> I strongly believe that SAML support in Outh2.0 and "SAML-interoperability" is crucial in getting Oauth accepted and deployed in high-assurance (high-value) environments (eg. government, financials…
+1.
> As such, if its ok with Brian, I would be willing to either co-author or review the SAML-related drafts.

Would review.

> ps. Apologies for stating the obvious, but I think the new charter/recharter should define clearly what is expected as deliverable(s) from the OAUTH WG in regards to SAML support.

+1

---

From: Mark Mcgloin <[email-masked]>
Date: Wed, 15 Sep 2010 18:50:59 +0100

Hi Torsten

Yes, I can contribute. Will email you directly to follow up

Regards
Mark McGloin

Torsten Lodderstedt <[email-masked]>

14/09/2010 17:01

regards,
Torsten.