Subject: [OAUTH-WG] Call for adoption - TMI BFF

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 3 May 2021 17:59:43 -0400

All,

This is a call for adoption for the *Token Mediating and Session
Information Backend for Frontend* as a WG document:
https://datatracker.ietf.org/doc/draft-bertocci-oauth2-tmi-bff/

Please, provide your feedback on the mailing list by *May 17th*.

Regards,
 Rifaat & Hannes

---

From: Dick Hardt <[email-masked]>
Date: Tue, 4 May 2021 07:39:53 -0700

I'm supportive -- but am concerned with the BFF acronym.
ᐧ

On Mon, May 3, 2021 at 3:00 PM Rifaat Shekh-Yusef <[email-masked]>
wrote:

> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: Aaron Parecki <[email-masked]>
Date: Tue, 4 May 2021 08:03:06 -0700

I support adoption. I'm also fine with the BFF acronym since it's common in
the software development world already. If anything, the TMI acronym is the
least strong of the two as it's missing a letter from the full name of the
draft.

Aaron

-- 
---
Aaron Parecki
https://aaronparecki.com

---

From: Dick Hardt <[email-masked]>
Date: Tue, 4 May 2021 08:25:36 -0700

My concern with BFF is that the common meaning is what the document calls
Full BFF -- so what many readers will assume is BFF is not what the
document is referring to.
ᐧ

On Tue, May 4, 2021 at 8:03 AM Aaron Parecki <[email-masked]> wrote:

> I support adoption. I'm also fine with the BFF acronym since it's common
> in the software development world already. If anything, the TMI acronym is
> the least strong of the two as it's missing a letter from the full name of
> the draft.
>
> Aaron
>
>
>
>
>> On Mon, May 3, 2021 at 3:00 PM Rifaat Shekh-Yusef <
>> [email-masked]> wrote:
>>
>>> All,
>>>

---

From: Seán Kelleher <[email-masked]>
Date: Tue, 4 May 2021 16:27:48 +0100

Hi all,

I'd like to hear others' take on Brock Allen's prior comment on the
document:

5) For me personally in all the consulting I've done helping customers use
> OIDC/OAuth over the past 7 years (since OIDC was released) I've never seen
> anyone trying to do it this way. I do believe that some people try this
> style, but I wonder if it's just because they don't know any better (so
> lacking guidance) or is it really because they're actively trying to
> mitigate the reverse proxy hop performance issue? If it's the former, then
> I don't agree that it makes sense to formalize a less secure approach when
> they simply need better guidance (which arguably is the "full BFF"
> approach), and thus the motivation for the document is slightly weakened
> (IMO).

I don't have as much exposure to the way lots of different groups are
implementing OAuth2/OIDC but I agree that this approach is novel for me,
and I'd be interested to hear others' thoughts on that aspect before the
document is adopted.

Apologies if this is the wrong place to voice such a concern. I would still
be very much interested in a discourse about the relative security and
positives/negatives of this approach regardless of the outcome.

Kind regards,

Seán.

---

From: Dick Hardt <[email-masked]>
Date: Tue, 4 May 2021 08:32:20 -0700

I have made up my own implementations that follow the pattern in the
document.

It keeps the security in the server, and allows the app to call the API
directly rather than through a backend proxy, which impacts latency and CX.
ᐧ

On Tue, May 4, 2021 at 8:27 AM Seán Kelleher <[email-masked]> wrote:

> Apologies if this is the wrong place to voice such a concern. I would
> still be very much interested in a discourse about the relative security
> and positives/negatives of this approach regardless of the outcome.
>
> Kind regards,
>
> Seán.
>

---

From: Jim Manico <[email-masked]>
Date: Tue, 4 May 2021 13:28:45 -0400

+1 Mr. Hardt. BFF aims to avoid access tokens in UA's so TMI-BFF is a 
badly branded name that will add confusion.

- Jim

On 5/4/21 11:25 AM, Dick Hardt wrote:
> My concern with BFF is that the common meaning is what the document 
> calls Full BFF -- so what many readers will assume is BFF is not what 
> the document is referring to.
> ᐧ
>
> On Tue, May 4, 2021 at 8:03 AM Aaron Parecki <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     I support adoption. I'm also fine with the BFF acronym since it's
>     common in the software development world already. If anything, the
>     TMI acronym is the least strong of the two as it's missing a
>     letter from the full name of the draft.
>
>     Aaron
>
>
>
>
>     On Tue, May 4, 2021 at 7:40 AM Dick Hardt <[email-masked]
>     <mailto:[email-masked]>> wrote:
>
>         On Mon, May 3, 2021 at 3:00 PM Rifaat Shekh-Yusef
>         <[email-masked] <mailto:[email-masked]>> wrote:
>
>             All,
>
>             This is a call for adoption for the *Token Mediating and
>             Session Information Backend for Frontend* as a WG document:
>             <https://datatracker.ietf.org/doc/draft-bertocci-oauth2-tmi-bff/>
>
>             [email-masked] <mailto:[email-masked]>
>             <https://www.ietf.org/mailman/listinfo/oauth>
>
>         [email-masked] <mailto:[email-masked]>
>         <https://www.ietf.org/mailman/listinfo/oauth>
>
>     -- 
>     ---
>     Aaron Parecki
>     https://aaronparecki.com <https://aaronparecki.com>
>
>

-- 
Jim Manico
Manicode Security
https://www.manicode.com

---

From: Aaron Parecki <[email-masked]>
Date: Tue, 4 May 2021 14:03:10 -0700

Okay, I have come around to this idea and agree that we shouldn't use "BFF"
to refer to this pattern. The only reason I am continuing the discussion in
this thread is that if we agree we should avoid the term BFF for this
draft, I would like to see it renamed before it is adopted, to avoid any
confusion at the start.

Aaron

On Tue, May 4, 2021 at 10:28 AM Jim Manico <[email-masked]> wrote:

> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
> --
> Jim Manico
> Manicode Securityhttps://www.manicode.com
>
>

---

From: Hans Zandbelt <[email-masked]>
Date: Tue, 4 May 2021 23:18:44 +0200

+1 for adoption, I'm impartial to the name

Hans.

On Tue, May 4, 2021 at 11:03 PM Aaron Parecki <[email-masked]> wrote:

> Okay, I have come around to this idea and agree that we shouldn't use
> "BFF" to refer to this pattern. The only reason I am continuing the
> discussion in this thread is that if we agree we should avoid the term BFF
> for this draft, I would like to see it renamed before it is adopted, to
> avoid any confusion at the start.
>
> Aaron
>
>

-- 
[email-masked]
ZmartZone IAM - www.zmartzone.eu

---

From: Brian Campbell <[email-masked]>
Date: Mon, 10 May 2021 16:42:31 -0600

FWIW, I did align the capitalization in the title, "Token Mediating and
session Information Backend For Frontend" to match the accrom. Somewhat
weak justification, I know, but I was going for the branding effect with
something memorable and (hopefully) funny.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._

---

From: Brian Campbell <[email-masked]>
Date: Wed, 12 May 2021 13:00:35 -0600

While I admit to being somewhat partial to the acronym, it's not for any
sound technical or informational reason. To be honest, before I became
enamored with my own perceived cleverness of TMI-BFF, I also thought the
use of "BFF" in the context of the draft wasn't quite appropriate.

At this point, I propose that Vittorio and I step back and rework the draft
a bit and then resume the call for adoption after we spin a new revision.
We'll eliminate the problematic use of BFF and address some of the more
straightforward feedback from the interim.

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 12 May 2021 15:14:17 -0400

Thanks, Brian!

I agree that this is the best course of action at this point.

Regards,
 Rifaat

On Wed, May 12, 2021 at 3:02 PM Brian Campbell <bcampbell=
[email-masked]> wrote:

> At this point, I propose that Vittorio and I step back and rework the
> draft a bit and then resume the call for adoption after we spin a new
> revision. We'll eliminate the problematic use of BFF and address some of
> the more straightforward feedback from the interim.
>
>
>
>>> calls Full BFF -- so what many readers will assume is BFF is not what the
>>>> common in the software development world already. If anything, the TMI
>>>> acronym is the least strong of the two as it's missing a letter from the
>>>> full name of the draft.
>>>>
>>>> Aaron
>>>>
>>>>
>>>>
>>>>
> *CONFIDENTIALITY NOTICE: This email may contain confidential and
> privileged material for the sole use of the intended recipient(s). Any
> review, use, distribution or disclosure by others is strictly prohibited.
> If you have received this communication in error, please notify the sender
> immediately by e-mail and delete the message and any file attachments from
> your computer. Thank you.*_______________________________________________
> OAuth mailing list
> [email-masked]