Re: [decade] An open issue for "An HTTP-based DECADE Resource Protocol".

[Songhaibin <[e-mail]>]

Hi Danhua,

Personally I think OAuth is a good base for the access and resource control. I realize that OAuth is also considering solutions to prevent token leaking or abuse. I think that's also useful for DECADE context.

-Haibin

From: [e-mail] [mailto:[e-mail]] On Behalf Of Wangdanhua
Sent: Saturday, August 25, 2012 5:30 PM
To: [e-mail]
Subject: [decade] An open issue for "An HTTP-based DECADE Resource Protocol".

Hi all,

The following is one of the open issues left for "An HTTP-based DECADE Resource Protocol" (draft-wang-drp). We're looking forward to your opinions and comments.
As to access and resource control, we authors once had several candidate protocols in our mind, they are Kerberos, AAA, and OAuth.

1. During the latest DECADE WG meeting in IETF 82nd Taipei, we realized that Kerberos isn't the right solution for resource control, since it works on the basis of "tickers" to allow nodes to prove their identity to one another in a secure manner.
2. As to AAA, it is mainly used in management environment. Extending the binary-value-pairs may be possible to grant network resources for data access, but a text-based protocol may be preferred.
3. OAuth 2.0 is used to grant access to the resource owner's resources from a third party without explicitly exposing the resource owner's credentials. Certain grant types can be extended for access and resource control in DECADE.

In summary, we believe that OAuth2.0 seems to be the most suitable protocol for DECADE access and resource control till now. Maybe it's time for us to write a protocol using OAuth 2.0 and see what problems we may meet.

Thanks a lot.

Best wishes,
Danhua Wang