Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

[Adam Dawes <[e-mail]>]

I believe this is ready for publication. Google will be making changes to
our proto RISC implementation to conform and will be looking forward to
getting real-world feedback on the spec.

On Wed, Aug 2, 2017 at 10:26 AM, Phil Hunt <[e-mail]> wrote:

> Nat,
>
> Thanks for the read.
>
> For #1 - should we move that paragraph to section 2 and leave some more
> generalized statement in section 1?
>
> For #2 - I think the paragraph starting “An outer JSON object that acts…”
> could be improved. Agreed that something along the lines of defined in JWT
> should be used.
>
> I recall #3 came up before as part of the delivery spec discussions.  My
> intent is that when using unsecured JWTs the receiver has to validate via
> the method of delivery.  E.g. was the JWT delivered over a mutually
> authenticated channel?
>
> Section 4.1 and 4.2 covers the issue albeit indirectly.
>
> I will go over the text and see what improvement could be made - probably
> in security considerations.
>
> Phil
>
> Oracle Corporation, Identity Cloud Services Architect & Standards
> @independentid
> www.independentid.com
> [e-mail]
>
> On Aug 2, 2017, at 10:07 AM, Nat Sakimura <[e-mail]> wrote:
>
> Thanks, it looks generally good. I had only three small nits.
>
> *1) "MUST NOT" in the introduction. *
> ---------------------------------------------------
> I feel that it is better to have this MUST NOT in the main text. The
> introduction often is skipped by a reader.
>
> *2) Potentially missing "defined in " in Section 2 the first bullet*
> ------------------------------------------------------------
> ------------------------------------------
> There seems to be missing "defined in" in the sentence "the JWT Token
> Claims Registry Section 10.1".
>
> *3) Issuer validation*
> ----------------------------------
> I am not sure how to do an issuer validation when using unsecured JWT.
> Adding more explanation would be beneficial.
>
> Best,
>
> Nat
>
> On Wed, Aug 2, 2017 at 1:18 AM M.Lizar@OCG <[e-mail]>
> wrote:
>
>> +1 on existing text .
>>
>> Agree the document is ready to publish
>>
>> - Mark
>>
>> On 31 Jul 2017, at 16:53, Mike Jones <[e-mail]> wrote:
>>
>> I believe that the specification is ready to publish as-is.  It already
>> meets the needs of the known use cases and is in production use.
>>
>>                                                                 -- Mike
>>
>> *From:* Id-event [mailto:[e-mail]
>> <[e-mail]>] *On Behalf Of *Yaron Sheffer
>> *Sent:* Monday, July 31, 2017 1:40 PM
>> *To:* SecEvent <[e-mail]>
>> *Subject:* [Id-event] WG Last Call for draft-ietf-secevent-token-02
>>
>>
>> This is to announce working group last call on this draft (
>> https://datatracker.ietf.org/doc/draft-ietf-secevent-token/
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dsecevent-2Dtoken_&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=34V_EUmT5gCZRmlH04kADdidPjoaKQgvob9KTHAK0Y0&e=>
>> ).
>>
>> Please send your comments to the list. Even if you are perfectly happy
>> with the draft, please let us know that you support its publication as-is
>> by posting to the list.
>>
>> Because of the summer holidays, this last call is open for 3 weeks, until
>> Aug. 21.
>>
>> Thanks,
>>     Dick and Yaron
>>
>> _______________________________________________
>> Id-event mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/id-event
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e=>
>>
>> _______________________________________________
>> Id-event mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/id-event
>> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_id-2Devent&d=DwMFaQ&c=RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9cnVXeoCkGMY9o&e=>
>>
> --
>
> Nat Sakimura
>
> Chairman of the Board, OpenID Foundation
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.
> ietf.org_mailman_listinfo_id-2Devent&d=DwICAg&c=
> RoP1YumCXCgaWHvlZYR8PQcxBKCX5YTpkKY057SbK10&r=
> JBm5biRrKugCH0FkITSeGJxPEivzjWwlNKe4C_lLIGk&m=Nj4D94_
> Z5TX7aZpILIENbLknqDGinZlFUseKss9KZyY&s=jgy3vjdjQKBEXv9AoYCSJ76EnSrAP9
> cnVXeoCkGMY9o&e=
>
>
>
> _______________________________________________
> Id-event mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/id-event
>
>


-- 
Adam Dawes | Sr. Product Manager | [e-mail] | [phone]