[Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)

Sabrina Tanamal via RT <drafts-expert-review-comment@iana.org> Tue, 10 March 2020 21:34 UTC

Return-Path: <iana-shared@icann.org>
X-Original-To: cwt-reg-review@ietfa.amsl.com
Delivered-To: cwt-reg-review@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE9AC3A0DFC for <cwt-reg-review@ietfa.amsl.com>; Tue, 10 Mar 2020 14:34:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.629
X-Spam-Level:
X-Spam-Status: No, score=-0.629 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, MISSING_HEADERS=1.021, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iPenkkohDhwm for <cwt-reg-review@ietfa.amsl.com>; Tue, 10 Mar 2020 14:34:29 -0700 (PDT)
Received: from smtp01.icann.org (smtp01.icann.org [192.0.33.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7463E3A0DFD for <cwt-reg-review@ietf.org>; Tue, 10 Mar 2020 14:34:29 -0700 (PDT)
Received: from request4.lax.icann.org (request1.lax.icann.org [10.32.11.221]) by smtp01.icann.org (Postfix) with ESMTP id 4D48AE0C8C for <cwt-reg-review@ietf.org>; Tue, 10 Mar 2020 21:34:29 +0000 (UTC)
Received: by request4.lax.icann.org (Postfix, from userid 48) id 485C32044B; Tue, 10 Mar 2020 21:34:29 +0000 (UTC)
RT-Owner: sabrina.tanamal
From: "Sabrina Tanamal via RT" <drafts-expert-review-comment@iana.org>
Reply-To: drafts-expert-review-comment@iana.org
In-Reply-To: <rt-4.4.3-22418-1582986347-1900.1158953-9-0@icann.org>
References: <RT-Ticket-1158953@icann.org> <03f0f73f-4c82-9089-0a81-471a5fb54ba8@gmx.de> <d23d83eb-44ef-bece-cfcc-61ee5d951cd8@gmx.de> <rt-4.4.3-14831-1579299068-1542.1158953-37-0@icann.org> <rt-4.4.3-21646-1582059958-678.1158953-37-0@icann.org> <BY5PR00MB06762A9651316668A1290016F5110@BY5PR00MB0676.namprd00.prod.outlook.com> <rt-4.4.3-21645-1582065742-299.1158953-37-0@icann.org> <rt-4.4.3-11175-1582675119-1846.1158953-37-0@icann.org> <4788cad0-d1dc-2947-9e17-cad4f2147a7b@gmx.de> <rt-4.4.3-22418-1582986347-1900.1158953-9-0@icann.org>
Message-ID: <rt-4.4.3-18243-1583876069-1900.1158953-9-0@icann.org>
X-RT-Loop-Prevention: IANA
X-RT-Ticket: IANA #1158953
X-Managed-BY: RT 4.4.3 (http://www.bestpractical.com/rt/)
X-RT-Originator: sabrina.tanamal@icann.org
CC: cwt-reg-review@ietf.org
Content-Type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Precedence: bulk
Date: Tue, 10 Mar 2020 21:34:29 +0000
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/cwt-reg-review/lj41hLZydqb0ntJSFo2lcDY0atQ>
Subject: [Cwt-reg-review] [IANA #1158953] Requested review for IANA registration in draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)
X-BeenThere: cwt-reg-review@ietf.org
X-Mailman-Version: 2.1.29
List-Id: CWT Registry Review <cwt-reg-review.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/cwt-reg-review>, <mailto:cwt-reg-review-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cwt-reg-review/>
List-Post: <mailto:cwt-reg-review@ietf.org>
List-Help: <mailto:cwt-reg-review-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/cwt-reg-review>, <mailto:cwt-reg-review-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Mar 2020 21:34:31 -0000

Hi all, 

Have you had a chance to review Ludwig's response below? 

Thanks,
Sabrina 

> I strongly disagree with the assessment that the scope claim should be
> pushed into the two-byte range.
> 
> The reason we introduced the scope claim is that an ACE RS typically
> does not have a direct connection to the AS, and is therefore unable
> to
> retrieve the scope of an access token from other sources than the
> access
> token itself.  I therefore assert that ACE access tokens would often
> need to contain this claim in order to inform the RS.
> Since one of the major drivers of the ACE work has been to reduce the
> authorization overhead (otherwise we could just have used vanilla
> OAuth
> 2.0), I find it strange to needlessly add to the overhead by making
> the
> encoding of a frequently used claim longer than necessary.
> 
> I am willing to listen to the arguments that have lead the expert
> reviewer to denying a value in the one-byte range, and discuss the
> reasoning further on list.
> 
> Regards,
> 
> Ludwig
> 
> 
> > On Tue Feb 18 22:42:22 2020, Michael.Jones@microsoft.com wrote:
> >> I'm mostly OK with these registrations, however, DO NOT assign the
> >> value 9 to "scope".   Rather, please put it in the two-byte range
> >> - for instance, with the value 41.
> >>
> >> -- Mike
> >>
> >> -----Original Message----- From: Cwt-reg-review
> >> <cwt-reg-review-bounces@ietf.org> On Behalf Of Sabrina Tanamal via
> >> RT Sent: Tuesday, February 18, 2020 1:06 PM Cc:
> >> cwt-reg-review@ietf.org Subject: [EXTERNAL] [Cwt-reg-review] [IANA
> >> #1158953] Requested review for IANA registration in
> >> draft-ietf-ace-oauth-authz (cwt - CBOR Web Token Claims)
> >>
> >> Hi all,
> >>
> >> Resending this request for draft-ietf-ace-oauth-authz.
> >>
> >> Thanks,
> >>
> >> Sabrina Tanamal Senior IANA Services Specialist
> >>
> >>> On Sat Dec 21 11:37:11 2019, ludwig_seitz@gmx.de wrote:
> >>>> Hello CWT registry reviewers,
> >>>>
> >>>> the IESG-designated experts for the CWT claims registry have
> >>>> asked me to send a review request to you about the claims
> >>>> registered here:
> >>>>
> >>>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fto
> >>>>
> >>>>
> ols.ietf.org%2Fhtml%2Fdraft-ietf-ace-oauth-authz-29%23section-
> >>>> 8.13&a
> >>>> mp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c3
> >>>>
> >>>>
> c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63717656
> >>>> 7656665548&amp;sdata=r01W5Bx0gJh9ZPH8eNS%2BY765CnGq11DkknsHYQ751Dk%3
> >>>>
> >>>>
> D&amp;reserved=0
> >>>>
> >>>> Thank you in advance for you review comments.
> >>>>
> >>>> Regards,
> >>>>
> >>>> Ludwig
> >>>>
> >>
> >> _______________________________________________ Cwt-reg-review
> >> mailing list Cwt-reg-review@ietf.org
> >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcwt-
> >>
> >>
> reg-
> >> review&amp;data=02%7C01%7CMichael.Jones%40microsoft.com%7Ce23f64ac1ad74269c3c408d7b4b65d45%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637176567656675543&amp;sdata=XxBhQmqxGkCRiBxh0PdhX2IJD8TnbwWl%2Feo8VUsHOsg%3D&amp;reserved=0
> >