Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-urn-sub-ns-03.txt

Hannes Tschofenig <> Thu, 21 June 2012 19:12 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7CCCF21F8799 for <>; Thu, 21 Jun 2012 12:12:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -102.493
X-Spam-Status: No, score=-102.493 tagged_above=-999 required=5 tests=[AWL=0.106, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id YiEgv9HzKMcJ for <>; Thu, 21 Jun 2012 12:12:35 -0700 (PDT)
Received: from ( []) by (Postfix) with SMTP id 06A4621F851C for <>; Thu, 21 Jun 2012 12:12:34 -0700 (PDT)
Received: (qmail invoked by alias); 21 Jun 2012 19:12:33 -0000
Received: from (EHLO []) [] by (mp012) with SMTP; 21 Jun 2012 21:12:33 +0200
X-Authenticated: #29516787
X-Provags-ID: V01U2FsdGVkX1/BvDZyNBXBZKOhQQ4CYxTw5dz38uc2qemJJtT6El Gm6IMefPkx2tcA
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Type: text/plain; charset="us-ascii"
From: Hannes Tschofenig <>
In-Reply-To: <>
Date: Thu, 21 Jun 2012 22:12:31 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <>
To: Mike Jones <>
X-Mailer: Apple Mail (2.1084)
X-Y-GMX-Trusted: 0
Cc: "" <>
Subject: Re: [OAUTH-WG] I-D Action: draft-ietf-oauth-urn-sub-ns-03.txt
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 21 Jun 2012 19:12:36 -0000

Hi Mike, 

Thanks for your mail. 

First, I would like to argue for a registry that has more than one level. We need a two level registry because the different extensions have (and will also in the future) have different extension policies. 

The structure of the registry is: urn:ietf:params:oauth:<class>:<id>

On the first level, the <class> part, we have high level functionality that was defined in the core specification. This includes things like 

1) authorization grants (which you call grant-type in your registration request in 

So, this would be urn:ietf:params:oauth:grant-type

2) client authentication mechanism (which you call client-assertion-type in but should rather mean something like client-auth-type) 

So, this could be something like urn:ietf:params:oauth:client-auth-type

3) Access Token Types (which is called 'token-type' in

This is urn:ietf:params:oauth:token-type. 

[PS: The text in the for registering new access token types is a bit confusing and I am not sure whether an absolute URI would actually be required even though it makes a lot of sense.]

While I believe that our initial requirement for "RFC required" for adding these top level classes makes sense since these basic extension features to OAuth are really core to the protocol functionality it is good that the group checks them carefully. 

Then, at the <id> level the individual values reside. For the authorization grant this is 'saml2-bearer' as defined in 

So, what is the right policy for adding values under urn:ietf:params:oauth:grant-type? says what the policy is. So, instead of re-deciding a new policy for adding entries here it would be good to get it inline with what the policy is in the core spec. 

What could go wrong if the two are not aligned? I actually had that case in the DIME working group. Without going into the details the registry had a much stronger policy (RFC required) than the protocol specification (which only required a specification, if I remember it). The consequence was that people couldn't easily register new values from other organizations since they would fail in the last step when a new registry value had to be created (since IANA then told them 'RFC Required'). Consequently, these other organizations who wanted to get their work done then avoided doing so by misusing other extensions, which was really not good.  

Mike, you have actually been suggesting that a three level category for certain classes of sub-registries is actually OK as well. That may be true and we could relax the text to say that whoever defines the class also decides about the structure of the child elements underneath it.  

What I believe we need to add in the document is to populate the registry with the three URIs (from above; referring to the classes) and pointing to the policy from the core specification. Then, other docs (like draft-ietf-oauth-json-web-token-00.txt) can just put their values in there. 


On Jun 21, 2012, at 9:14 PM, Mike Jones wrote:

> This draft is much clearer.  Thanks for the quick turn-around.
> One question:  You added:
>  *Index value: values subordinate to urn:ietf:params:oauth are of the from urn:ietf:params:oauth:<class>:<id> with <class>:<id> as the index value
> Why bake the assumption of a two-level structure into the registry?
> For instance, you could easily imagine legal and useful registrations of the form <class>:<subclass>:<id>, etc.
> Maybe change this to say:
>  *Index value: values subordinate to urn:ietf:params:oauth are of the from urn:ietf:params:oauth:<value> with <value> as the index value.  It is suggested that <value> include both a "class" and an "identifier-within-class" component, with the two components being separated by a colon (":"); other compositions of the <value> may also be used.
> 				-- Mike
> -----Original Message-----
> From: [] On Behalf Of
> Sent: Thursday, June 21, 2012 10:53 AM
> To:
> Cc:
> Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-urn-sub-ns-03.txt
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Web Authorization Protocol Working Group of the IETF.
> 	Title           : An IETF URN Sub-Namespace for OAuth
> 	Author(s)       : Brian Campbell
>                          Hannes Tschofenig
> 	Filename        : draft-ietf-oauth-urn-sub-ns-03.txt
> 	Pages           : 7
> 	Date            : 2012-06-21
> Abstract:
>   This document establishes an IETF URN Sub-namespace for use with
>   OAuth related specifications.
> The IETF datatracker status page for this draft is:
> There's also a htmlized version available at:
> A diff from previous version is available at:
> Internet-Drafts are also available by anonymous FTP at:
> _______________________________________________
> OAuth mailing list
> _______________________________________________
> OAuth mailing list