Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions

William Mills <wmills@yahoo-inc.com> Mon, 17 October 2011 20:53 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A0781F0C4E for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 13:53:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.165
X-Spam-Level:
X-Spam-Status: No, score=-17.165 tagged_above=-999 required=5 tests=[AWL=0.433, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqsV3MZJwKuW for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 13:53:22 -0700 (PDT)
Received: from nm34-vm1.bullet.mail.ne1.yahoo.com (nm34-vm1.bullet.mail.ne1.yahoo.com [98.138.229.81]) by ietfa.amsl.com (Postfix) with SMTP id 4F8921F0C49 for <oauth@ietf.org>; Mon, 17 Oct 2011 13:53:21 -0700 (PDT)
Received: from [98.138.90.53] by nm34.bullet.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 20:53:18 -0000
Received: from [98.138.88.232] by tm6.bullet.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 20:53:18 -0000
Received: from [127.0.0.1] by omp1032.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 20:53:18 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 169504.73975.bm@omp1032.mail.ne1.yahoo.com
Received: (qmail 50693 invoked by uid 60001); 17 Oct 2011 20:53:17 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1318884797; bh=d6OzlhKgeFO4/66kHKxRZIG/iELtXN/QpXmNVCYVCT0=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=a7x4umpeCnnQ6A2bXGgB7qt9sxjC333htTEzvfwloebyhkUTtWq58Pd7u6dEPV/ObDgXptsmh2FRZ91gFn591FZmlp0Hkmpo1hhrFG5EdQF051579ML9ujugky5X74rpYpFNpaqYJf9NNkEavGfHttQF+af4HKmKdjHSz1xySxw=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=eWwjBB/fP5cuG7ooPtEGY3qaw/ycWp8d+HSf1UHSDavB2zI6aiGPSD5lht5RPssazCy/0TVMwcBnWJa6qRz4A3z0M2/eg65jeRj2Bb19HbGZV35CVD7LJa0KR1Qpaglaaw5MdH9mV0Pb47v7owaedUzwB6v+ugPn1wMurR5veqw=;
X-YMail-OSG: zI7YUQAVM1l.65KeP4K8wx_lotFm_JbgATy3YNuj748cBYM Y5FJrZNzeJ.aVoK_nACHeVIuIjgzQB0_Kx8NQcEAVpV_.ekVLUqL2PG9VpOB SfOl3MqO_F9pBn5DdbNSNRmml.B5NtcobL820bwkF_hhi14M.IKkckUHPNYp GLw4SborSKH43VtIx_zIn5XGiu7GFjvkvZ8_Mo3AHBgh5FtkfJbJdcj4T.is 3zvqR8agdqCaKLboLzrKtl1le8B_YISKEpMQ8qD7Dxxyoup1xwBwJ79dffQT QilJXMFpl0k7UN9PMPO_zhgDfbaMOcHY9zdd1a5u_mfP_aiEIn35VuhVj9VH EBd0SluRdBCql5IruWqGxCsr5nYd2yV8wMtyxQo_zIj4tx1WkblREy7fXPNa xAWdkj4MDFAw8CZnOX1PwTiWUGV5BThuN
Received: from [209.131.62.115] by web31813.mail.mud.yahoo.com via HTTP; Mon, 17 Oct 2011 13:53:17 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.115.325013
References: <4E1F6AAD24975D4BA5B16804296739435C23C5A6@TK5EX14MBXC284.redmond.corp.microsoft.com><7A22B287-CC99-4FD7-84DF-8FF5DA871FC6@gmx.net><4E1F6AAD24975D4BA5B16804296739435C23CAFE@TK5EX14MBXC284.redmond.corp.microsoft.com><89BE3D9D-AB1D-44B2-BA7D-0C0D74BCA885@gmx.net> <4E1F6AAD24975D4BA5B16804296739435C23CC9D@TK5EX14MBXC284.redmond.corp.microsoft.com> <999913AB42CC9341B05A99BBF358718DAABC44@FIESEXC035.nsn-intra.net> <4E1F6AAD24975D4BA5B16804296739435C23EA6A@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9AB561.5060904@gmx.de> <4E1F6AAD24975D4BA5B16804296739435C23F5B6@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9B1BA6.2060704@gmx.de> <90C41DD21FB7C64BB94121FBBC2E723452604B908A@P3PW5EX1MB01.EX1.SECURESERVER.NET>, <9E5660BC-C797-454B-B2AF-48AB3E886AC7@ve7jtb.com> <B33BFB58CCC8BE4998958016839DE27EA769@IMCMBX01.MITRE.ORG> <62D2DE5D-AEBE-4A75-9C36-7A51E63DC7C3@ve7jtb.com> <90C41DD21FB7C64BB94121FBBC2E723452604B9102@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4DF35A25-989C-4BE4-8ACD-35 20DDB8BDE9@gmx.net> <90C41DD21FB7C64BB94121FBBC2E723452604B9197@P3PW5EX1MB01.EX1.SECURESERVER.NET> <0AE463C6-254C-4776-A6EC-08DBE3F8A7F1@ve7jtb.com>
Message-ID: <1318884797.81519.YahooMailNeo@web31813.mail.mud.yahoo.com>
Date: Mon, 17 Oct 2011 13:53:17 -0700 (PDT)
From: William Mills <wmills@yahoo-inc.com>
To: John Bradley <ve7jtb@ve7jtb.com>, Eran Hammer-Lahav <eran@hueniverse.com>
In-Reply-To: <0AE463C6-254C-4776-A6EC-08DBE3F8A7F1@ve7jtb.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2115303481-1318884797=:81519"
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Oct 2011 20:53:23 -0000

+1



________________________________
From: John Bradley <ve7jtb@ve7jtb.com>
To: Eran Hammer-Lahav <eran@hueniverse.com>
Cc: OAuth WG <oauth@ietf.org>
Sent: Monday, October 17, 2011 12:13 PM
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions

+1

On 2011-10-17, at 11:53 AM, Eran Hammer-Lahav wrote:

> All I agree with is to limit the scope character-set in the v2 spec to the subset of ASCII allowed in HTTP header quoted-string, excluding " and \ so no escaping is needed, ever.
> 
> EHL
> 
>> -----Original Message-----
>> From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net]
>> Sent: Monday, October 17, 2011 8:25 AM
>> To: Eran Hammer-Lahav
>> Cc: Hannes Tschofenig; John Bradley; Richer, Justin P.; OAuth WG
>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
>> Proposed Resolutions
>> 
>> It is good that we have an agreement among a few people that more text
>> needs to be provided in the core specification on the issue of the scope
>> element.
>> 
>> Now, there is still the question of what the text should say. The questions
>> from my earlier mails are therefore still applicable and need an answer.
>> 
>> Ciao
>> Hannes
>> 
>> On Oct 17, 2011, at 7:27 AM, Eran Hammer-Lahav wrote:
>> 
>>> I agree.
>>> 
>>> EHL
>>> 
>>>> -----Original Message-----
>>>> From: John Bradley [mailto:ve7jtb@ve7jtb.com]
>>>> Sent: Monday, October 17, 2011 6:07 AM
>>>> To: Richer, Justin P.
>>>> Cc: Eran Hammer-Lahav; OAuth WG
>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
>>>> Proposed Resolutions
>>>> 
>>>> The scopes cross all of the profiles.
>>>> 
>>>> I expect that restricting the character sets for bearer tokens, MAC,
>>>> and other future variants should be dealt with in those profiles.
>>>> 
>>>> Without restricting scope in core, we leave the possibility of coming
>>>> up with different rules in different profiles e.g. MAC vs Bearer.
>>>> 
>>>> It is probably best to have one rule in core that works across all the
>> profiles.
>>>> 
>>>> John B.
>>>> On 2011-10-16, at 7:19 PM, Richer, Justin P. wrote:
>>>> 
>>>>> I think the limit makes sense, but then are tokens limited by the
>>>>> same
>>>> rules? They need to live in all the same places (query parameters,
>>>> headers,
>>>> forms) that scopes do and would be subject to the same kinds of
>>>> encoding woes that scopes will. Or am I missing something obvious as
>>>> to why this isn't a problem for tokens (both bearer tokens and the
>>>> public part of MAC tokens) but is a problem for scope strings?
>>>>> 
>>>>> -- Justin
>>>>> ________________________________________
>>>>> From: oauth-bounces@ietf.org [oauth-bounces@ietf.org] on behalf of
>>>>> John Bradley [ve7jtb@ve7jtb.com]
>>>>> Sent: Sunday, October 16, 2011 8:11 PM
>>>>> To: Eran Hammer-Lahav
>>>>> Cc: OAuth WG
>>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
>>>> Proposed Resolutions
>>>>> 
>>>>> Restricting it now in the core spec is going to save a lot of headaches
>> later.
>>>>> 
>>>>> John B.
>>>>> On 2011-10-16, at 3:54 PM, Eran Hammer-Lahav wrote:
>>>>> 
>>>>>> It's an open question for the list.
>>>>>> 
>>>>>> EHL
>>>>>> 
>>>>>>> -----Original Message-----
>>>>>>> From: Julian Reschke [mailto:julian.reschke@gmx.de]
>>>>>>> Sent: Sunday, October 16, 2011 11:00 AM
>>>>>>> To: Mike Jones
>>>>>>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); Hannes Tschofenig; OAuth
>>>>>>> WG; Eran Hammer-Lahav
>>>>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues
>>>>>>> & Proposed Resolutions
>>>>>>> 
>>>>>>> On 2011-10-16 18:44, Mike Jones wrote:
>>>>>>>> As Eran wrote on 9/30, "The fact that the v2 spec allows a wide
>>>>>>>> range of
>>>>>>> characters in scope was unintentional. The design was limited to
>>>>>>> allow simple ASCII strings and URIs."
>>>>>>>> ...
>>>>>>> 
>>>>>>> I see. Thanks.
>>>>>>> 
>>>>>>> Is this going to be clarified in -23?
>>>>>>> 
>>>>>>> Best regards, Julian
>>>>>> _______________________________________________
>>>>>> OAuth mailing list
>>>>>> OAuth@ietf.org
>>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>>>> 
>>>>> _______________________________________________
>>>>> OAuth mailing list
>>>>> OAuth@ietf.org
>>>>> https://www.ietf.org/mailman/listinfo/oauth
>>> 
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
> 


_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth