Re: [http-auth] FW: New Version Notification for draft-woodworth-json-http-auth-00.txt

["Woodworth, John R" <[e-mail]>]

> -----Original Message-----
> From: Julian Reschke [mailto:[e-mail]]
>
> On 2017-03-03 10:16, Woodworth, John R wrote:
> > All,
> >
> > I understand this is late to the party but was hoping some of you
> > may have time to review our new draft.  We welcome any questions,
> > comments and assistance from the group.
> > ...
>
> Hi there,
>
>
> a few formal nits:
>
> - please don't put "httpauth" on the front page if the draft isn't
> a Working Group draft - that said, *do* add a note to the front page
> with instructions where to send feedback (this list is fine for that)
>

Hi Julian,

First, thank you for looking at our draft and your comments, we are
very excited to have feedback so quickly.

We understand listing the intended WG is premature and it will be
removed as suggested.

> - you IPR statement looks weird:
>
> > This document may contain material from IETF Documents or IETF
> > Contributions published or made publicly available before November 10,
> > 2008.

Again, thank you.

This is an oversight and was mistakenly left in from another draft we
are working on.  It will be removed in our next release.

>
> - registering a whole set of auth schemes isn't going to fly; please
> also consider removing the somewhat weird pipe characters from
> the scheme name...
>

This draft is currently experimental but intended to be somewhat of
an umbrella for a "class" of schemes.  We understand this may be
different than currently available schemes but it is something which
makes ours different.  Any advice you have for registering a scheme
"class" would be appreciated.

The pipe is rather critical to the draft as it is used as an
"indicator" for intent.  As I understand it, it is a legal character
and was chosen for another project we are working on as others were
unavailable to the scheme name.  We are rather happy with the way
it is currently working in our implementation and felt it would be
a good idea to share our solution with an even larger community.

It (the pipe) is used to indicate our scheme "class" and allow for
scripts in the browser to offer authentication ahead of the built-in
logic offered by the browser.  For example, if one tries to implement
the "Basic" scheme in a script providing a pretty themed page, it
will undoubtedly be rudely intercepted by the browser via an ugly
login popup without any scripting or theming capabilities.  Our
draft hopes to offer an alternate path.

We debated taking it (the pipe) out of some of the titles and
references but the protocol chaining feature we are introducing
relies on it in order to properly function.


Thanks again,
John

> Best regards, Julian
>

-- THESE ARE THE DROIDS TO WHOM I REFER:
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.