Re: [OAUTH-WG] draft-15 editorials

[Paul Madsen <[e-mail]>]

Hi James, sorry I didnt see your earlier suggestion.

And your text works for me - just looking for text that hints at 
something beyond delegation

thanks

paul

On 4/6/11 11:15 PM, Manger, James H wrote:
>
> Paul,
>
> The draft-15.1 abstract is just the first sentence of the abstract I 
> suggested last month 
> [http://www.ietf.org/mail-archive/web/oauth/current/msg05693.html and 
> below]. The rest covered OAuth's other major aspect: issuing temporary 
> credentials that resource servers can handle, while a separate service 
> can handle permanent or exotic credentials (eg assertions). Does it 
> fit what you were after?
>
> Your "directly negotiate access" phrase hints that there is more to 
> OAuth 2 than delegation, but I'm not sure that it explains it.
>
> --
>
> James Manger
>
> *From:*[e-mail] [mailto:[e-mail]] *On 
> Behalf Of *Paul Madsen
> *Sent:* Thursday, 7 April 2011 1:15 AM
> *To:* Eran Hammer-Lahav
> *Cc:* [e-mail]
> *Subject:* Re: [OAUTH-WG] draft-15 editorials
>
> Proposed text
>
> The OAuth 2.0 authorization protocol enables a third-party application 
> to obtain limited access to an HTTP service, either on behalf of an 
> end-user by orchestrating an approval interaction between the end-user 
> and the HTTP service, or by allowing the third-party application to 
> directly 'negotiate', on its own behalf, such access with the HTTP 
> service.
>
> And I acknowledge the concerns that 'negotiate' might create, thus the 
> air quotes ....
>
> paul
>
> *From:*[e-mail] [mailto:[e-mail]] *On 
> Behalf Of *Manger, James H
> *Sent:* Thursday, 17 March 2011 1:40 PM
> *To:* OAuth WG
> *Subject:* [OAUTH-WG] OAuth2 abstract
>
> Comments on draft-ietf-oauth-v2-13:
>
> 1. *Abstract*
>
> The 1-line abstract is not helpful -- it merely repeats the title. The 
> abstract is important as it is the text most widely seem around the 
> rest of the IETF community (eg in announcements of drafts and RFCs) 
> and beyond. It needs to mention: users delegating access to 
> applications; applications orchestrating that delegation; swapping 
> permanent credentials for short-lived access tokens; and that it uses 
> HTTP. Here is my suggestion:
>
>   "The OAuth 2.0 authorization protocol allows an application to gain
>   limited permission to access an HTTP service on behalf of a user by
>   orchestrating an approval interaction between the user and the service.
>   OAuth 2.0 uses temporary credentials, issued by an HTTP service either
>   directly to an application or to represent user-delegated permissions.
>   A collection of HTTP services can accept temporary credentials without
>   needing to handle long-term user or application credentials, which
>   can be restricted to a secure service that issues the temporary
>   credentials."
>
> I think this text can be understood without knowing any of the 
> specialised terms introduced later in the specification.
>
> --
>
> James Manger
>