[OAUTH-WG] Mohamed Boucadair's No Objection on draft-ietf-oauth-rfc7523bis-10: (with COMMENT)

[Mohamed Boucadair via Datatracker <[e-mail]>]

Mohamed Boucadair has entered the following ballot position for
draft-ietf-oauth-rfc7523bis-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-rfc7523bis/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Hi Mike, Brian, Chuck, and Filip,

Thank you for the effort put into this document and working out these fixes.

Thanks to Luigi Iannone for the OPSDIR review and to the authors for the
changes made in -08 to address Luigi’s feedback.

# OLD/NEW Pattern

This may be a matter of taste, but I would prefer if we have an OLD/NEW pattern
through the document to explicitly identify the updates we are making, more
convenient for readers/reviewers to avoid ping-ping between various documents,
and also ease identifying the changes.

For example, Section 5 would be updated to say:

OLD:

| Audience
|      A value that identifies the party or parties intended to process
|      the assertion.  The URL of the token endpoint, as defined in
|      Section 3.2 of OAuth 2.0 [RFC6749], can be used to indicate that
|      the authorization server is a valid intended audience of the
|      assertion.  In the absence of an application profile specifying
|      otherwise, compliant applications MUST compare the Audience values
|      using the Simple String Comparison method defined in Section 6.2.1
|      of RFC 3986 [RFC3986].

NEW:

  Audience
     A value that identifies the party intended to process the
     assertion.  The issuer identifier of the authorization server, as
     defined in [RFC8414], can be used to indicate that the
     authorization server is a valid intended audience of the
     assertion.

## Having the text back to back, highlights that the NEW text does not have
“parties” and does not include last part.

## The last sentence of the OLD is in the NEW update to 7523.

## Having some commentary text to explain the changes would help.

Cheers,
Med