Re: [OAUTH-WG] OAuth Milestone Update and Rechartering

Anthony Nadalin <> Wed, 14 May 2014 21:16 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 51AF41A01E3 for <>; Wed, 14 May 2014 14:16:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id uXCbST6krFYj for <>; Wed, 14 May 2014 14:16:50 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 411831A01E1 for <>; Wed, 14 May 2014 14:16:50 -0700 (PDT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.949.11; Wed, 14 May 2014 21:16:42 +0000
Received: from ([]) by ([]) with mapi id 15.00.0949.001; Wed, 14 May 2014 21:16:42 +0000
From: Anthony Nadalin <>
To: John Bradley <>, Brian Campbell <>
Thread-Topic: [OAUTH-WG] OAuth Milestone Update and Rechartering
Thread-Index: AQHPawEbu8OzlywPcU+RkLqz+fSkNptACOgAgABdhACAADcWgA==
Date: Wed, 14 May 2014 21:16:41 +0000
Message-ID: <>
References: <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
x-forefront-prvs: 0211965D06
x-forefront-antispam-report: SFV:NSPM; SFS:(428001)(24454002)(189002)(199002)(377454003)(53754006)(19617315010)(83072002)(86362001)(85852003)(76576001)(92566001)(19618635001)(50986999)(19300405004)(19273905006)(19625215002)(15198665003)(15202345003)(77096999)(16236675002)(15395725003)(2656002)(76176999)(87936001)(64706001)(74502001)(81542001)(81342001)(31966008)(15975445006)(20776003)(76482001)(101416001)(80022001)(66066001)(77982001)(74662001)(46102001)(4396001)(21056001)(99286001)(79102001)(74316001)(33646001)(54356999)(19609705001)(19580395003)(19580405001)(83322001)(18206015023)(86612001)(42262001)(9984715005)(24736002); DIR:OUT; SFP:; SCL:1; SRVR:BLUPR03MB309;; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (: does not designate permitted sender hosts)
authentication-results: spf=none (sender IP is );
Content-Type: multipart/alternative; boundary="_000_5bc620f21ba6446e8925476d4646bad5BLUPR03MB309namprd03pro_"
MIME-Version: 1.0
Cc: "" <>
Subject: Re: [OAUTH-WG] OAuth Milestone Update and Rechartering
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 14 May 2014 21:16:55 -0000

Please list the implementstions

From: OAuth [] On Behalf Of John Bradley
Sent: Wednesday, May 14, 2014 10:59 AM
To: Brian Campbell
Subject: Re: [OAUTH-WG] OAuth Milestone Update and Rechartering

I know a number of people implementing

Having it on a RFC track may make sense.

I remain to be convinced that a4c ads anything other than confusion.

If the WG wants to take it up it should be aligned with Connect.  I think there are more important things to spend time on.

Sent from my iPhone

On May 14, 2014, at 2:24 PM, Brian Campbell <<>> wrote:
I would object to 'OAuth Authentication' being picked up by the WG as a work item. The starting point draft has expired and it hasn't really been discusses since Berlin nearly a year ago.  As I recall, there was only very limited interest in it even then. I also don't believe it fits well with the WG charter.

I would suggest the WG consider picking up 'OAuth Symmetric Proof of Possession for Code Extension' for which there is an excellent starting point of - it's a relativity simple security enhancement which addresses problems currently being encountered in deployments of native clients.

On Thu, May 8, 2014 at 3:04 PM, Hannes Tschofenig <<>> wrote:
Hi all,

you might have seen that we pushed the assertion documents and the JWT
documents to the IESG today. We have also updated the milestones on the
OAuth WG page.

This means that we can plan to pick up new work in the group.
We have sent a request to Kathleen to change the milestone for the OAuth
security mechanisms to use the proof-of-possession terminology.

We also expect an updated version of the dynamic client registration
spec incorporating last call feedback within about 2 weeks.

We would like you to think about adding the following milestones to the
charter as part of the re-chartering effort:


Nov 2014 Submit 'Token introspection' to the IESG for consideration as a
Proposed Standard
Starting point: <draft-richer-oauth-introspection-04>

Jan 2015 Submit 'OAuth Authentication' to the IESG for consideration as
a Proposed Standard
Starting point: <draft-hunt-oauth-v2-user-a4c-01>

Jan 2015 Submit 'Token Exchange' to the IESG for consideration as a
Proposed Standard
Starting point: <draft-jones-oauth-token-exchange-00>


We also updated the charter text to reflect the current situation. Here
is the proposed text:


Charter for Working Group

The Web Authorization (OAuth) protocol allows a user to grant a
third-party Web site or application access to the user's protected
resources, without necessarily revealing their long-term credentials,
or even their identity. For example, a photo-sharing site that
supports OAuth could allow its users to use a third-party printing Web
site to print their private pictures, without allowing the printing
site to gain full control of the user's account and without having the
user share his or her photo-sharing sites' long-term credential with
the printing site.

The OAuth 2.0 protocol suite encompasses

* a protocol for obtaining access tokens from an authorization
server with the resource owner's consent,
* protocols for presenting these access tokens to resource server
for access to a protected resource,
* guidance for securely using OAuth 2.0,
* the ability to revoke access tokens,
* standardized format for security tokens encoded in a JSON format
  (JSON Web Token, JWT),
* ways of using assertions with OAuth, and
* a dynamic client registration protocol.

The working group also developed security schemes for presenting
authorization tokens to access a protected resource. This led to the
publication of the bearer token, as well as work that remains to be
completed on proof-of-possession and token exchange.

The ongoing standardization effort within the OAuth working group will
focus on enhancing interoperability and functionality of OAuth
deployments, such as a standard for a token introspection service and
standards for additional security of OAuth requests.


Feedback appreciated.

Hannes & Derek

OAuth mailing list<>

[Ping Identity logo]<>

Brian Campbell
Portfolio Architect


+1 720.317.2061

Connect with us…

[twitter logo]<>[youtube logo]<>[LinkedIn logo]<>[Facebook logo]<>[Google+ logo]<>[slideshare logo]<>[flipboard logo]<>[rss feed icon]<>

[Register for Cloud Identity Summit 2014 | Modern Identity Revolution | 19–23 July, 2014 | Monterey, CA]<>

OAuth mailing list<>