Re: [kitten] Ben Campbell's No Objection on draft-ietf-kitten-sasl-oauth-22: (with COMMENT)

[Bill Mills <[e-mail]>]

 Responses inline below tagged with [[WMILLS]]


     On Wednesday, May 27, 2015 8:56 PM, Benjamin Kaduk <[e-mail]> wrote:
   

 Hi Ben,

On Wed, 27 May 2015, Ben Campbell wrote:

> Hi, thanks for the response. A few comments below. I removed sections that do
> not seem to need further discussion.
>
> On 27 May 2015, at 17:49, Bill Mills wrote:
>
> [...]
>
> > >  > -- 3: "Such a new SASL OAuth mechanism can be added by simply>  
> > >  registering the new name(s)"> > Register them where?
> > s/by simply registering the new name(s)/by registering the new name(s) with
> > IANA/
> > change made in my working copy.
>
> Sorry, I guess I was asking for which registry at IANA.

The SASL Mechanisms registry; the only one affected by this document.
[[WMILLS]] changed wording to "registering the new name(s) with IANA in the SASL Mechanisms registry"

> > >  > -- 3.2, 2nd paragraph : "... known to the application."> > Known to the
> > > "resource server"?
> > this is server config and in protocol data that the app could have, so I'd
> > rather leave this as "application" but if there's strong desire for
> > "resource server" I'll make the change.
>
> Do I understand correctly that we are talking about matching things like host
> and port sent by the client to things the server "knows" through other
> channels?  It seems like "application" could mean application at the client as
> well as the server, or even the combination of both. Maybe "application
> server"? (Or maybe I've missed the intent?)

Things like host and port that could be extracted from the OS or http
stack or similar, yes.  I don't particularly care for "resource server"
here, but "application server" seems unobjectionable.

[[wmills]] WFM "application server" it is.

> > >  > Editorial Stuff:> > -- 3.1, "Port":> > I assume that means the
> > > destination port to which the client connected?> (similar to Host?)> > --
> > > 3.1.1 "Post": default value is "". > > Does "" represent an empty string?
> > Yes, does this need to be spelled out?
>
> "Need" might be too strong a word, but I think a description like "empty"
> would be more clear than '""'.

[[WMILLS]] changed those to "the default value is the empty string ("")."

I agree that it's probably worth doing "destination port to which the
client connected".  I have no strong feelings regarding the way in which
the empty string is described.
[[WMILLS]] WFM now "Contains the destination port that the client connected to, represented as a  decimal positive integer string without leading zeros."

> > >  > -- 3.2, first sentence"> > s/" ... according the specification..." /
> > > "... according to the specification..."
>
> [...]

Indeed.

-Ben