IETF Logo Mail Archive

Re: [OAUTH-WG] First draft of OAuth 2.0

David Recordon <recordond@gmail.com> Tue, 23 March 2010 19:19 UTC

Return-Path: <recordond@gmail.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8ADDD3A6358 for <oauth@core3.amsl.com>; Tue, 23 Mar 2010 12:19:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.169
X-Spam-Level:
X-Spam-Status: No, score=-0.169 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lnZPNtd9YCcM for <oauth@core3.amsl.com>; Tue, 23 Mar 2010 12:19:24 -0700 (PDT)
Received: from mail-pz0-f204.google.com (mail-pz0-f204.google.com [209.85.222.204]) by core3.amsl.com (Postfix) with ESMTP id 8574F3A6984 for <oauth@ietf.org>; Tue, 23 Mar 2010 12:19:23 -0700 (PDT)
Received: by pzk42 with SMTP id 42so451381pzk.32 for <oauth@ietf.org>; Tue, 23 Mar 2010 12:19:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=3hdfxqXuUdHuxiZ6FqAGumZ5L1KlRByFpS1XhXnlYPc=; b=VBoakZ+exX87Ls6ka5GhH7GBdBHUoJaP1s7h0PQG4fQWpnHOEwmTLsf+3WjfGBSncC nVgrOWPEBW3n7yIrQG2/qFkb1wJi7FAL62xJ1we85WIAz93ORvySFsoBRcjIXtABJQxC xN1pEr1c5Jgvaejr/EZn3U3VdrzVf60yxE7pA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=Hx53jcHPlwjRGjbIfjM93e41aiQ7g/Aa078kJVYseg6cDYVwaVSjel3YQtBMGew8my PEX/hfNbKxo/eO36HMm/Wv27j8Ln2gWZ1jeTTJv+WTJHQ5CcMJhsp3UMQt3ZQMTZy1BV JxWaBiSkrQKgXyCHU/GzjFyZqFMhN3iMTuV/4=
MIME-Version: 1.0
Received: by 10.115.37.28 with SMTP id p28mr779639waj.218.1269371982893; Tue, 23 Mar 2010 12:19:42 -0700 (PDT)
In-Reply-To: <C7CE6006.28E9%cmortimore@salesforce.com>
References: <fd6741651003231047s419db471x98098a2e46aab168@mail.gmail.com> <C7CE6006.28E9%cmortimore@salesforce.com>
Date: Tue, 23 Mar 2010 12:19:42 -0700
Message-ID: <fd6741651003231219s57b8d96flb825cf32e5e5dd90@mail.gmail.com>
From: David Recordon <recordond@gmail.com>
To: Chuck Mortimore <cmortimore@salesforce.com>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] First draft of OAuth 2.0
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Mar 2010 19:19:26 -0000

Missed it, included now!
http://github.com/daveman692/OAuth-2.0/commit/099c51025d33e9a9350468c3e57482785d9826e8

On Tue, Mar 23, 2010 at 12:09 PM, Chuck Mortimore
<cmortimore@salesforce.com> wrote:
> By the way, did you see my little note at the end?   It was kind of buried.
>
>
> I think the oauth_mode param is missing from your initial POST examples in
> 2.4 and 2.5
>
> -cmort
>
>
> On 3/23/10 10:47 AM, "David Recordon" <recordond@gmail.com> wrote:
>
> Hey Chuck,
> Thanks for rewriting the SAML flow into the style of my draft!  I
> really appreciate it.
>
> I originally dropped the SAML flow because I hadn't seen support for
> it on the mailing list(s) the past two months.  I think that our
> default should be making the spec as short and simple as possible so
> removed a few things from WRAP in order to start conversations like
> this one.  It's now clear that Google, Microsoft, Salesforce, and IBM
> all need the SAML profile.  Chuck, I'll merge your wording in.  Want
> to be listed as an author?
>
> We're also going to need to figure out which flows should be in the
> core spec versus which should be developed at the same time but in
> individual documents.
>
> Thanks,
> --David
>
> On Tue, Mar 23, 2010 at 4:50 AM, Torsten Lodderstedt
> <torsten@lodderstedt.net> wrote:
>> +1 for assertion support
>>
>> what about enhancing the flow #2.4 to accept any kind of user credentials
>> (username/password, SAML assertions, other authz servers tokens)
>>
>> regards,
>> Torsten.
>>
>> Am 23.03.2010 um 12:42 schrieb Mark Mcgloin <mark.mcgloin@ie.ibm.com>:
>>
>>> +1 for assertion profile. Was there any reason why it was dropped?
>>>
>>> On 3/23/10, Chuck Mortimore wrote:
>>>>
>>>> Just getting a chance to review this – I apologize for not getting this
>>>
>>> before the meeting started.
>>>
>>>> We’d like to see some form of an Assertion Profile, similar to section
>>>> 5.2
>>>
>>> from draft-hardt-oauth-01.   We have strong customer use-cases for an
>>> assertion based flow, specifically SAML bearer tokens, and I >believe
>>> Microsoft may have already shipped a minor variation on this ( wrap_SAML
>>> )
>>> in Azure.
>>>
>>>
>>> Mark McGloin
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>>
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>>
>
>

v2.23.0 | Report a Bug | By Email