Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
Eran Hammer-Lahav <eran@hueniverse.com> Mon, 17 October 2011 19:09 UTC
Return-Path: <eran@hueniverse.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C39C21F8C80 for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 12:09:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.47
X-Spam-Level:
X-Spam-Status: No, score=-2.47 tagged_above=-999 required=5 tests=[AWL=0.129, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9i6W+xgnNkft for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 12:09:28 -0700 (PDT)
Received: from p3plex1out02.prod.phx3.secureserver.net (p3plex1out02.prod.phx3.secureserver.net [72.167.180.18]) by ietfa.amsl.com (Postfix) with SMTP id 2B68D21F8B3F for <oauth@ietf.org>; Mon, 17 Oct 2011 12:09:25 -0700 (PDT)
Received: (qmail 29869 invoked from network); 17 Oct 2011 18:54:15 -0000
Received: from unknown (HELO smtp.ex1.secureserver.net) (72.167.180.47) by p3plex1out02.prod.phx3.secureserver.net with SMTP; 17 Oct 2011 18:54:14 -0000
Received: from P3PW5EX1MB01.EX1.SECURESERVER.NET ([10.6.135.19]) by P3PW5EX1HT005.EX1.SECURESERVER.NET ([72.167.180.134]) with mapi; Mon, 17 Oct 2011 11:53:48 -0700
From: Eran Hammer-Lahav <eran@hueniverse.com>
To: Hannes Tschofenig <hannes.tschofenig@gmx.net>
Date: Mon, 17 Oct 2011 11:53:43 -0700
Thread-Topic: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
Thread-Index: AcyM6d4wnMmHqnZaTgqyfYFK6i43BgAFA8yw
Message-ID: <90C41DD21FB7C64BB94121FBBC2E723452604B9197@P3PW5EX1MB01.EX1.SECURESERVER.NET>
References: <4E1F6AAD24975D4BA5B16804296739435C23C5A6@TK5EX14MBXC284.redmond.corp.microsoft.com><7A22B287-CC99-4FD7-84DF-8FF5DA871FC6@gmx.net><4E1F6AAD24975D4BA5B16804296739435C23CAFE@TK5EX14MBXC284.redmond.corp.microsoft.com><89BE3D9D-AB1D-44B2-BA7D-0C0D74BCA885@gmx.net> <4E1F6AAD24975D4BA5B16804296739435C23CC9D@TK5EX14MBXC284.redmond.corp.microsoft.com> <999913AB42CC9341B05A99BBF358718DAABC44@FIESEXC035.nsn-intra.net> <4E1F6AAD24975D4BA5B16804296739435C23EA6A@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9AB561.5060904@gmx.de> <4E1F6AAD24975D4BA5B16804296739435C23F5B6@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9B1BA6.2060704@gmx.de> <90C41DD21FB7C64BB94121FBBC2E723452604B908A@P3PW5EX1MB01.EX1.SECURESERVER.NET>, <9E5660BC-C797-454B-B2AF-48AB3E886AC7@ve7jtb.com> <B33BFB58CCC8BE4998958016839DE27EA769@IMCMBX01.MITRE.ORG> <62D2DE5D-AEBE-4A75-9C36-7A51E63DC7C3@ve7jtb.com> <90C41DD21FB7C64BB94121FBBC2E723452604B9102@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4DF35A25-989C-4BE4-8ACD-3520DDB8BDE9@gmx.net>
In-Reply-To: <4DF35A25-989C-4BE4-8ACD-3520DDB8BDE9@gmx.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Oct 2011 19:09:29 -0000
All I agree with is to limit the scope character-set in the v2 spec to the subset of ASCII allowed in HTTP header quoted-string, excluding " and \ so no escaping is needed, ever. EHL > -----Original Message----- > From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net] > Sent: Monday, October 17, 2011 8:25 AM > To: Eran Hammer-Lahav > Cc: Hannes Tschofenig; John Bradley; Richer, Justin P.; OAuth WG > Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & > Proposed Resolutions > > It is good that we have an agreement among a few people that more text > needs to be provided in the core specification on the issue of the scope > element. > > Now, there is still the question of what the text should say. The questions > from my earlier mails are therefore still applicable and need an answer. > > Ciao > Hannes > > On Oct 17, 2011, at 7:27 AM, Eran Hammer-Lahav wrote: > > > I agree. > > > > EHL > > > >> -----Original Message----- > >> From: John Bradley [mailto:ve7jtb@ve7jtb.com] > >> Sent: Monday, October 17, 2011 6:07 AM > >> To: Richer, Justin P. > >> Cc: Eran Hammer-Lahav; OAuth WG > >> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & > >> Proposed Resolutions > >> > >> The scopes cross all of the profiles. > >> > >> I expect that restricting the character sets for bearer tokens, MAC, > >> and other future variants should be dealt with in those profiles. > >> > >> Without restricting scope in core, we leave the possibility of coming > >> up with different rules in different profiles e.g. MAC vs Bearer. > >> > >> It is probably best to have one rule in core that works across all the > profiles. > >> > >> John B. > >> On 2011-10-16, at 7:19 PM, Richer, Justin P. wrote: > >> > >>> I think the limit makes sense, but then are tokens limited by the > >>> same > >> rules? They need to live in all the same places (query parameters, > >> headers, > >> forms) that scopes do and would be subject to the same kinds of > >> encoding woes that scopes will. Or am I missing something obvious as > >> to why this isn't a problem for tokens (both bearer tokens and the > >> public part of MAC tokens) but is a problem for scope strings? > >>> > >>> -- Justin > >>> ________________________________________ > >>> From: oauth-bounces@ietf.org [oauth-bounces@ietf.org] on behalf of > >>> John Bradley [ve7jtb@ve7jtb.com] > >>> Sent: Sunday, October 16, 2011 8:11 PM > >>> To: Eran Hammer-Lahav > >>> Cc: OAuth WG > >>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & > >> Proposed Resolutions > >>> > >>> Restricting it now in the core spec is going to save a lot of headaches > later. > >>> > >>> John B. > >>> On 2011-10-16, at 3:54 PM, Eran Hammer-Lahav wrote: > >>> > >>>> It's an open question for the list. > >>>> > >>>> EHL > >>>> > >>>>> -----Original Message----- > >>>>> From: Julian Reschke [mailto:julian.reschke@gmx.de] > >>>>> Sent: Sunday, October 16, 2011 11:00 AM > >>>>> To: Mike Jones > >>>>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); Hannes Tschofenig; OAuth > >>>>> WG; Eran Hammer-Lahav > >>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues > >>>>> & Proposed Resolutions > >>>>> > >>>>> On 2011-10-16 18:44, Mike Jones wrote: > >>>>>> As Eran wrote on 9/30, "The fact that the v2 spec allows a wide > >>>>>> range of > >>>>> characters in scope was unintentional. The design was limited to > >>>>> allow simple ASCII strings and URIs." > >>>>>> ... > >>>>> > >>>>> I see. Thanks. > >>>>> > >>>>> Is this going to be clarified in -23? > >>>>> > >>>>> Best regards, Julian > >>>> _______________________________________________ > >>>> OAuth mailing list > >>>> OAuth@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/oauth > >>> > >>> _______________________________________________ > >>> OAuth mailing list > >>> OAuth@ietf.org > >>> https://www.ietf.org/mailman/listinfo/oauth > > > > _______________________________________________ > > OAuth mailing list > > OAuth@ietf.org > > https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Is… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Tschofenig, Hannes (NSN - FI/Espoo)
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Richer, Justin P.
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Phil Hunt
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer