Re: [OAUTH-WG] Proposed Syntax Changes in Dynamic Registration

Phil Hunt <phil.hunt@oracle.com> Mon, 20 May 2013 17:51 UTC

Return-Path: <phil.hunt@oracle.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 092A721F8F6E for <oauth@ietfa.amsl.com>; Mon, 20 May 2013 10:51:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.428
X-Spam-Level:
X-Spam-Status: No, score=-5.428 tagged_above=-999 required=5 tests=[AWL=-0.226, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ki-EiRuDxmrQ for <oauth@ietfa.amsl.com>; Mon, 20 May 2013 10:51:11 -0700 (PDT)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by ietfa.amsl.com (Postfix) with ESMTP id 2BB2721F94F5 for <oauth@ietf.org>; Mon, 20 May 2013 10:51:10 -0700 (PDT)
Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by userp1040.oracle.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id r4KHp61i008667 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 20 May 2013 17:51:07 GMT
Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r4KHp777016297 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 20 May 2013 17:51:08 GMT
Received: from abhmt114.oracle.com (abhmt114.oracle.com [141.146.116.66]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r4KHp7Gq016293; Mon, 20 May 2013 17:51:07 GMT
Received: from [192.168.1.125] (/174.7.250.104) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 20 May 2013 10:51:07 -0700
References: <519A3C9A.8060305@mitre.org> <9D2C4D6F-EBC0-4313-B3B1-5981A865A604@oracle.com> <519A4607.1030900@mitre.org> <DF861D80-C924-427D-9678-08AF9CCB5A61@oracle.com> <519A5261.1010506@mitre.org> <4E1F6AAD24975D4BA5B168042967394367742D5A@TK5EX14MBXC283.redmond.corp.microsoft.com>
Mime-Version: 1.0 (1.0)
In-Reply-To: <4E1F6AAD24975D4BA5B168042967394367742D5A@TK5EX14MBXC283.redmond.corp.microsoft.com>
Content-Type: multipart/alternative; boundary="Apple-Mail-A5BEFF2D-6A6B-4B40-ABCD-3FE243421554"
Content-Transfer-Encoding: 7bit
Message-Id: <278419A3-8FFE-45F6-81A8-90D5CFFC13CB@oracle.com>
X-Mailer: iPhone Mail (10B329)
From: Phil Hunt <phil.hunt@oracle.com>
Date: Mon, 20 May 2013 10:51:02 -0700
To: Mike Jones <Michael.Jones@microsoft.com>
X-Source-IP: acsinet21.oracle.com [141.146.126.237]
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Proposed Syntax Changes in Dynamic Registration
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 May 2013 17:51:17 -0000

-1

The draft has features that are unclear and will double the operational cost. The fact that it works doesn't mean it is ready from the wg perspective. 

For the production use, has anyone outside of oidc implemented and placed in production?

As a non-oidc implementer, I can't make the same assumptions (like discovery) that oidc umplementers have. 

Phil

On 2013-05-20, at 9:48, Mike Jones <Michael.Jones@microsoft.com> wrote:

> The deployment evidence doesn’t support your position, Phil.  There are over a dozen interoperable implementations already deployed.  Those deployments demonstrate that the spec, as written, is already doing one thing well – enabling clients (as defined by RFC 6749) to register with Authorization Servers, obtaining client_id and optionally client_secret values that enable those clients to use those Authorization Servers.  Doing one thing well is exactly what we should be striving for, and the evidence says that we’ve achieved that.
>  
> It’s time to ship it!
>  
>                                                                 -- Mike
>  
> From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Justin Richer
> Sent: Monday, May 20, 2013 9:42 AM
> To: Phil Hunt
> Cc: oauth@ietf.org
> Subject: Re: [OAUTH-WG] Proposed Syntax Changes in Dynamic Registration
>  
> I, of course, disagree. But that's what we're trying to figure out as a working group, after all.
> 
>  -- Justin
> 
> On 05/20/2013 12:41 PM, Phil Hunt wrote:
> This draft isn't ready for LC. 
> 
> Phil
> 
> On 2013-05-20, at 8:49, Justin Richer <jricher@mitre.org> wrote:
> 
> But also keep in mind that this is last-call, and that we don't really want to encourage avoidable drastic changes at this stage. 
> 
>  -- Justin
> 
> 
> On 05/20/2013 11:21 AM, Phil Hunt wrote:
> Keep in mind there may be other changes coming. 
>  
> The issue is that new developers can't figure out what token is being referred to. 
> 
> Phil
> 
> On 2013-05-20, at 8:09, Justin Richer <jricher@mitre.org> wrote:
> 
> Phil Hunt's review of the Dynamic Registration specification has raised a couple of issues that I felt were getting buried by the larger discussion (which I still strongly encourage others to jump in to). Namely, Phil has suggested a couple of syntax changes to the names of several parameters. 
> 
> 
> 1) expires_at -> client_secret_expires_at
> 2) issued_at -> client_id_issued_at
> 3) token_endpoint_auth_method -> token_endpoint_client_auth_method
> 
> 
> I'd like to get a feeling, especially from developers who have deployed this draft spec, what we ought to do for each of these:
> 
>  A) Keep the parameter names as-is
>  B) Adopt the new names as above
>  C) Adopt a new name that I will specify
> 
> In all cases, clarifying text will be added to the parameter *definitions* so that it's more clear to people reading the spec what each piece does. Speaking as the editor: "A" is the default as far as I'm concerned, since we shouldn't change syntax without very good reason to do so. That said, if it's going to be better for developers with the new parameter names, I am open to fixing them now.
> 
> Naming things is hard.
> 
>  -- Justin
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>  
>