Re: [OAUTH-WG] draft-hunt-oauth-software-statement-00

Phil Hunt <> Fri, 01 November 2013 19:55 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A068F11E81A4 for <>; Fri, 1 Nov 2013 12:55:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.268
X-Spam-Status: No, score=-6.268 tagged_above=-999 required=5 tests=[AWL=0.331, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 3G-Nbg75MpGM for <>; Fri, 1 Nov 2013 12:55:03 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 86DFC11E811D for <>; Fri, 1 Nov 2013 12:55:03 -0700 (PDT)
Received: from ( []) by (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id rA1JsxPv010601 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 1 Nov 2013 19:55:00 GMT
Received: from ( []) by (8.14.4+Sun/8.14.4) with ESMTP id rA1Jswex004678 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 1 Nov 2013 19:54:59 GMT
Received: from ( []) by (8.14.4+Sun/8.14.4) with ESMTP id rA1Jswef025962; Fri, 1 Nov 2013 19:54:58 GMT
Received: from [] (/ by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 01 Nov 2013 12:54:58 -0700
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Phil Hunt <>
In-Reply-To: <>
Date: Fri, 1 Nov 2013 12:54:48 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <>
To: Hannes Tschofenig <>
X-Mailer: Apple Mail (2.1510)
X-Source-IP: []
Cc: " WG" <>
Subject: Re: [OAUTH-WG] draft-hunt-oauth-software-statement-00
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 01 Nov 2013 19:55:08 -0000

See below...


On 2013-11-01, at 12:13 PM, Hannes Tschofenig <> wrote:

> Hi Phil, Hi Tony, Hi all,
> regarding this document I believe there are the following questions the group may want to think about:
> a) Is the lifecycle of software development (Figure 1) common accross several companies?

We are trying to be generic. What we are trying to do is take the old model where a developer would register with a Facebook, a Google, whatever and apply it to what happens to open source API and commercial API scenarios where software is deployed in many locations (not just a single cloud provider).
> b) The document defines a number of attributes. Are those attributes also used in other deployments? Is their semantic clearly defined so that meaningful actions can be taken when receiving those?

The attributes come from Dynamic Registration.  Only thing new here is software_id and software_version. 
> c) Is the proposed approach for conveying the software statement acceptable for the group?
> (currently the information is conveyed as a bearer token encoded as JWT).

John Bradley's JWT token is similar, but I think they have different characteristics in the way they are used.  I'd like to here John present this at the meeting before I attempt to try and compare them.  This is something I'd like to work on together.
> What would be good to have is two things:
> * Examples
> * Text that describes what decisions can be made by the introduction of the software assertions. This text could go into the introduction to provide a motivation about why to use it.

I am open to a lot of change her. If anything, my feeling is that if anything we should cut the drafts back down to the raw normative text.  It is my feeling there is too much explanatory text that drives the perception that the proposal is complex.  Yet this boils down to 3 methods:

Static - do what you are doing now if that works.
Dynamic - Swap a software statement (shared by all instances of the same app) for an individual client assertion (assertion swap)
Transient - just pass your software_id (or maybe it should be software statement) as you client_id

> Ciao
> Hannes
> _______________________________________________
> OAuth mailing list