Re: [oauth] OAUTH Charter Proposal

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

OAuth has two compontents. The authorization component is a very  
lightweight capabilities system which is mostly left up to the SP to  
define. It defines the requirements of the access token (capability)  
and how to access the resource. It does not currently provide the  
fine grained control that an authz protocol usually provides (see c- 
lists, acls). It doesn't need it, but is the right place for it if  
such control were necessary. The key is that this capability grants  
access to a resource, therefore it is authz.

The other part is very similar to Kerberos ticket granting, which you  
might call token negotiation, brokered authentication, or delegation.  
This is about requesting the access token. It is completely optional,  
and may be left out (see thmbnl implementation), or replaced (see  
hybrid protocol). While this used to be a service provided by  
authentication protocols, clearly OAuth proves that ticket granting  
and authentication may be separate protocols. OAuth could become  
authn by stating what credentials could be sent directly to the  
Authorization endpoint. If this was defined, then OAuth would be  
functionally equivalent to a Kerberos TGS or WS-Trust STS. Normally  
these protocols do not necessarily grant access to any resource,  
clearly putting them outside the realm of authz. Since OAuth does  
grant access, it is unique among protocols.

No I don't think they belong in separate specs, but it is useful to  
look at this in terms of traditional security protocols. But what  
matters is not so much the terms, as matters the formalization of the  
protocol. I suggest we create a mailing list oauth-authz-authn- 
flamewar to continue this discussion.

http://josephholsten.com

On Feb 2, 2009, at 12:49 PM, Eran Hammer-Lahav wrote:

> Of course, even ‘delegation’ is a problematic term. HTTP Basic auth  
> is not considered a delegation protocol but it really is. The End  
> User gives the User Agent some credentials to access resources on  
> its behalf on the Web Server. There is no restriction in Basic auth  
> about the number of credentials used, so there could be a special  
> one to give the browser.
>
>
>
> Hmm. I guess that makes OAuth a ‘goddamn goddamn protocol’, if we  
> replace all the problematic words… of course that does not help us  
> at all.
>
>
>
> I would not waste too much time trying to find a one liner to  
> describe the protocol. And when in doubt, the Core 1.0 spec defines  
> a framework for us to work with, and can always be used to draw the  
> lines of what we are trying to solve.
>
>
>
> EHL
>
>
>
> _______________________________________________
> oauth mailing list
> oauth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

http://josephholsten.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAkmHgW4ACgkQrPgSa0qMrmGmvQCfSgEOykkwMUmnfId1X8+K01AR
FbcAni93Rq91mtuYCHlQBFiFwuOwJokz
=6H9y
-----END PGP SIGNATURE-----
_______________________________________________
oauth mailing list
oauth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth