Re: [OAUTH-WG] Review of draft-ietf-oauth-assertions-03

[Brian Campbell <[e-mail]>]

Hi Hannes,

Near the end of §1 of your draft -04 you discuss client authentication with
the Resource Server by saying that the client authentication concerns steps
(E) and (F) in figure 1. However, my reading of §2.3 of the core OAuth
Framework[1] was that only client authentication to the AS was in scope for
the spec. Following from that, my assumption and intent with the assertion
spec was that client assertion authentication is only defined for a client
authenticating to the token endpoint of an AS. §3 of the -03 of the
assertions doc[2] even says, "This specification provides a model for using
assertions for authentication of an OAuth client during interactions with
an Authorization Server".

Was there something in the -03 draft (or the core spec for that matter)
that suggested it was intended for client to RS authentication? I don't
think specifying that (other than in defining how an access token is
presented like draft-ietf-oauth-v2-bearer does) that would be appropriate.
Maybe some clarification is needed?

Thanks,
Brian

[1] http://tools.ietf.org/html/draft-ietf-oauth-v2-28#section-2.3
[2] http://tools.ietf.org/html/draft-ietf-oauth-assertions-03#section-3

On Sun, Jun 24, 2012 at 7:42 AM, Hannes Tschofenig <
[e-mail]> wrote:

> Hi Brian,
>
> thanks for your response. I have tried to put additional text into version
> -04 of the draft to address my earlier comments.
>
> The most recent version of the updated document is there:
>
> https://github.com/hannestschofenig/tschofenig-ids/blob/master/oauth-assertions/draft-ietf-oauth-assertions-04.txt
>
> Here is the XML:
>
> https://github.com/hannestschofenig/tschofenig-ids/blob/master/oauth-assertions/draft-ietf-oauth-assertions-04.xml
>
> It took me a little while to make these changes, as you can imagine. I
> hope I was able to improve the quality and clarity of the document.
>
> I still have to respond to your second mail about the relaxed usage of the
> RFC 2119 language. Will do that asap.
>
> Ciao
> Hannes
>
>