Re: [kitten] Kerberos Preauth Registration for OAuth2 device flow

[Benjamin Kaduk <[e-mail]>]

Thanks all for the great discussion so far.

On Thu, Nov 18, 2021 at 03:15:22PM -0700, Sam Hartman wrote:
> >>>>> "Greg" == Greg Hudson <[e-mail]> writes:
> 
>     Greg> On 11/9/21 5:39 PM, Sam Hartman wrote:
>     >> On the interoperability side, the protocol between the KDC and
>     >> the OAuth provider does not appear to be described at all.  You
>     >> get vendor lockin between a KDC and OAuth provider as far as I
>     >> can tell.
> 
>     Greg> Preauth mechs don't generally specify back-end protocols;
>     Greg> certainly RFC 6560 does not.
> 
> I think it's the first preauth mechanism where that was an issue.
> My thoughts at the time reading the draft was that the kind of tokens
> used for OTP were fairly well understood  and it wasn't a big deal.
> 
> I think my answer here is that I personally don't mind the  backend
> protocol being out of scope, and no one else in the WG seems to mind
> either, so it is okay.

While I personally would prefer to specify the backend protocol, I think
that the current trends in the IETF are that this kind of backend protocol
does not need to be fully specified.

-Ben