Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

[Mike Jones <[e-mail]>]

Thanks for the useful review, Nat.  Proposed resolutions are inline below.

FYI, Annabelle Backman and I sat down last week during the Internet Identity Workshop (IIW) and read through all the WGLC comments.  The series of replies to come contains proposed resolutions we discussed.

From: Nat Sakimura [mailto:[e-mail]]
Sent: Wednesday, August 2, 2017 10:07 AM
To: M.Lizar@OCG <[e-mail]>; Mike Jones <[e-mail]>
Cc: Yaron Sheffer <[e-mail]>; SecEvent <[e-mail]>
Subject: Re: [Id-event] WG Last Call for draft-ietf-secevent-token-02

Thanks, it looks generally good. I had only three small nits.

1) "MUST NOT" in the introduction.
---------------------------------------------------
I feel that it is better to have this MUST NOT in the main text. The introduction often is skipped by a reader.

Agreed:  Propose changing “MUST NOT” to “cannot”.

2) Potentially missing "defined in " in Section 2 the first bullet
------------------------------------------------------------------------------------------------------
There seems to be missing "defined in" in the sentence "the JWT Token Claims Registry Section 10.1".

I’ll change this reference to [IANA.JWT.Claims] with target https://www.iana.org/assignments/jwt/jwt.xhtml#claims.

3) Issuer validation
----------------------------------
I am not sure how to do an issuer validation when using unsecured JWT.
Adding more explanation would be beneficial.

I propose adding this additional sentence to the paragraph you referenced:
“Likewise if the profile allows (or requires) that the JWT be unsecured, the means by which the integrity of the JWT is ensured MUST be specified.”

Best,

Nat

                                                                Thanks,
                                                                -- Mike

On Wed, Aug 2, 2017 at 1:18 AM M.Lizar@OCG<mailto:M.Lizar@OCG> <[e-mail]<mailto:[e-mail]>> wrote:
+1 on existing text .

Agree the document is ready to publish

- Mark

On 31 Jul 2017, at 16:53, Mike Jones <[e-mail]<mailto:[e-mail]>> wrote:

I believe that the specification is ready to publish as-is.  It already meets the needs of the known use cases and is in production use.

                                                                -- Mike

From: Id-event [mailto:[e-mail]] On Behalf Of Yaron Sheffer
Sent: Monday, July 31, 2017 1:40 PM
To: SecEvent <[e-mail]<mailto:[e-mail]>>
Subject: [Id-event] WG Last Call for draft-ietf-secevent-token-02

This is to announce working group last call on this draft (https://datatracker.ietf.org/doc/draft-ietf-secevent-token/).

Please send your comments to the list. Even if you are perfectly happy with the draft, please let us know that you support its publication as-is by posting to the list.

Because of the summer holidays, this last call is open for 3 weeks, until Aug. 21.

Thanks,
    Dick and Yaron
_______________________________________________
Id-event mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/id-event
_______________________________________________
Id-event mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/id-event
--

Nat Sakimura

Chairman of the Board, OpenID Foundation