Re: [Ace] Security Domains

If the two owners in question are, as described below, the resource owner and the client owner, this actually seems to align nicely with UMA's resource owner and requesting party (defined as "An end-user, or a corporation or other legal person, that uses the client to seek access to a protected resource. The requesting party may or may not be the same party as the resource owner."). A goodly part of the UMA architecture is dedicated to details necessary to separate these two entities.

http://tools.ietf.org/html/draft-hardjono-oauth-umacore-09

Eve Maler (sent from my iPad)
cell +1 425 345 6756
eve@xmlgrrl.com

> On Jun 4, 2014, at 6:41 AM, George Fletcher <gffletch@aol.com> wrote:
> 
> Just a quick comment. The OAuth2 flows started from a "single-owner" perspective and just doesn't cover a lot of use cases so the work by the User Managed Access (UMA) group in the Kantara Initiative is working to address access to resources by arbitrary (as yet not introduced) entities. Not exactly the same as the "multi-owner" problem but there are some similarities.
> 
> I'm in favor of supporting a multi-owner model.
> 
> Thanks,
> George
> 
>> On 6/3/14, 10:15 AM, Carsten Bormann wrote:
>>> On 03 Jun 2014, at 15:51, Rene Struik <rstruik.ext@gmail.com> wrote:
>>> 
>>> I did not really get yet what the disagreement is about, so maybe
>>> someone can help me with that.
>> Here in Stockholm there was a relatively extended discussion whether it is worth to separate the client owner and the resource owner function in the architecture and analogously separate out the Authorization Manager (less-constrained counterpart of the client) from the Authorization Server (less-constrained counterpart of the resource server).  
>> 
>> http://tools.ietf.org/html/draft-gerdes-ace-actors takes the view that this exercise is worthwhile.
>> 
>> Obviously, this is an architectural model and does not say anything how these functions are mapped to specific devices in a specific deployment.  If you don’t separate out the functions in the architecture, I believe the result will be single-owner thinking and it will be very hard to later address the multiple-owner aspect that is so central to the Internet of Things idea.  Others believe that initial deployments will all be single-owner and it will be hard to drum up input to an architecture enabled for multiple owners, but it will be relatively easy to extend the single-owner architecture later.
>> 
>> Grüße, Carsten
>> 
>> _______________________________________________
>> Ace mailing list
>> Ace@ietf.org
>> https://www.ietf.org/mailman/listinfo/ace
>> 
>> 
> 
> _______________________________________________
> Ace mailing list
> Ace@ietf.org
> https://www.ietf.org/mailman/listinfo/ace