Re: [OAUTH-WG] Dynamic Client Registration

William Mills <wmills@yahoo-inc.com> Sat, 14 April 2012 16:01 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA33221F85EF for <oauth@ietfa.amsl.com>; Sat, 14 Apr 2012 09:01:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -16.815
X-Spam-Level:
X-Spam-Status: No, score=-16.815 tagged_above=-999 required=5 tests=[AWL=-0.023, BAYES_00=-2.599, HTML_MESSAGE=0.001, SARE_URI_CONS7=0.306, URI_NOVOWEL=0.5, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AqSoqAZiRnN6 for <oauth@ietfa.amsl.com>; Sat, 14 Apr 2012 09:01:15 -0700 (PDT)
Received: from nm12-vm2.bullet.mail.ne1.yahoo.com (nm12-vm2.bullet.mail.ne1.yahoo.com [98.138.91.88]) by ietfa.amsl.com (Postfix) with SMTP id C32D021F84D2 for <oauth@ietf.org>; Sat, 14 Apr 2012 09:01:14 -0700 (PDT)
Received: from [98.138.90.54] by nm12.bullet.mail.ne1.yahoo.com with NNFMP; 14 Apr 2012 16:01:05 -0000
Received: from [98.138.89.246] by tm7.bullet.mail.ne1.yahoo.com with NNFMP; 14 Apr 2012 16:01:05 -0000
Received: from [127.0.0.1] by omp1060.mail.ne1.yahoo.com with NNFMP; 14 Apr 2012 16:01:05 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 603772.9311.bm@omp1060.mail.ne1.yahoo.com
Received: (qmail 10149 invoked by uid 60001); 14 Apr 2012 16:01:05 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1334419265; bh=V8lws0wTMNOD39J3Qfk8/foKT2KdsZU244UjvBdw2vw=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=EIZ86n0d3ShHIEF4OKv2rkm+3KvdtoXf1g3pejgNSjaxUIBjwMHBz0gZ6hAg58xHReKWo3gG1CJxwC0ZKDMc/8UdciMehINFRye5inQE2EiXkBqkIL/om39XCdRJwCiQ5G5DiE9r94I+2t3HA9bZ3qlkIzt5Sz76KB/NoxnuX6o=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=j2s3tSqXjnAWDMWBRnLCQpR8wmVZSH3tpdBiAct0hMXiUzd43KDf6JKLm9+Pnunz32ij6vFCYWi+vfWe3iYgQSfxXHHBOXl6ERKtllGIphB4mIxecoiEQdtEr9mRnQiGeKZEfPRFnEyq4UDYMjR0oh+0OeSjIEkS1CUAISQIJ98=;
X-YMail-OSG: OklQW10VM1lyuOatjzcM2PndxUmNrpaFRNiSh93Jw2wH9pJ 7qJjlIKtSYZDiAVhn8ixPjOQy8d2BpUujTpMZds3.yrOumFCLkbc0in_p56w Itt6Z_tCXgcJyP70ylZNYwLFbSfhON1L7MyXSR3nInktHH39geu1OHCWjigq XlwF4DlBvPPhO92E_5cT.Jjkh1.4K8gKXDT8f68LSOzf7f0BLjP8f.gcPieA 1fDy7yw.qN2763Y5ZES9G8iHSaJqgy7ehpYCZF9X5iAYh92nPbVx6cRRIAjQ xqivOYUDbLn48vaj.trDM58.THcNzW2RWXMTv28g78eJBO4uZ57dQbTEfqSn S0FoFUpnpOArkuLsrVN0gqrTnKe3cEhDaYvXlnAsDtSkYpBhBecYHnco3z5U SOntdinVH3EmOLtX.u1gLXTQ8sBmec68xtD4E.gtyn99Yftkea_K_Dpc9..V Cd_aN2EzF5NfGuq1z2qEQhpPmIKKSOL2uR4qP9ts-
Received: from [99.31.212.42] by web31816.mail.mud.yahoo.com via HTTP; Sat, 14 Apr 2012 09:01:05 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.118.349524
References: <5F51A14F-D548-4D29-B20F-5C3DCB3CB705@gmx.net> <3E72A308-75EE-4F5C-96CC-A51F0B81106A@xmlgrrl.com>
Message-ID: <1334419265.3552.YahooMailNeo@web31816.mail.mud.yahoo.com>
Date: Sat, 14 Apr 2012 09:01:05 -0700 (PDT)
From: William Mills <wmills@yahoo-inc.com>
To: Eve Maler <eve@xmlgrrl.com>, Hannes Tschofenig <hannes.tschofenig@gmx.net>
In-Reply-To: <3E72A308-75EE-4F5C-96CC-A51F0B81106A@xmlgrrl.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="-1238014912-742085045-1334419265=:3552"
Cc: "oauth@ietf.org WG" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Dynamic Client Registration
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 14 Apr 2012 16:01:16 -0000

Yeah, SCIM as a way to federate and distribute info like this seems sane, with extensions for the data items we need here.  The hard part is still around the security stuff which they have not dealt with yet, and that's going to be a blocker until it's solved.  Authority to update elemnts or namespaces is going to be needed, and that's a hard problem.

-bill




>________________________________
> From: Eve Maler <eve@xmlgrrl.com>
>To: Hannes Tschofenig <hannes.tschofenig@gmx.net> 
>Cc: "oauth@ietf.org WG" <oauth@ietf.org> 
>Sent: Friday, April 13, 2012 6:29 PM
>Subject: Re: [OAUTH-WG] Dynamic Client Registration
> 
>Hi Hannes-- That's kind of a cool idea. You're right that it's a "client account" of sorts. At least worth exploring, I'd say, unless a SCIM expert pipes up with a reason why not.
>
>    Eve
>
>On 13 Apr 2012, at 7:36 AM, Hannes Tschofenig wrote:
>
>> Hi all, 
>> 
>> at the IETF#83 OAuth working group meeting we had some confusion about the Dynamic Client Registration and the Simple Web Discovery item. I just listened to the audio recording again. 
>> 
>> With the ongoing mailing list discussion regarding WebFinger vs. Simple Web Discovery I hope that folks had a chance to look at the documents again and so the confusion of some got resolved.  
>> 
>> I believe the proposed new charter item is sufficiently clear with regard to the scope of the work. Right? 
>> Here is the item again:
>> "
>> Jul. 2013  Submit 'OAuth Dynamic Client Registration Protocol' to the IESG for consideration as a Proposed Standard
>> 
>> [Starting point for the work will be 
>> http://tools.ietf.org/html/draft-hardjono-oauth-dynreg
>> ] 
>> "
>> 
>> Of course there there is a relationship between Simple Web Discovery (or WebFinger) and the dynamic client registration since the client first needs to discover the client registration endpoint at the authorization server before interacting with it. 
>> 
>> Now, one thing that just came to my mind when looking again at draft-hardjono-oauth-dynreq was the following: Could the Client Registration Request and Response protocol exchange could become a profile of the SCIM protocol? In some sense this exchange is nothing else than provisioning an account at the Authorization Server (along with some meta-data).
>> 
>> Is this too far fetched? 
>> 
>> Ciao
>> Hannes
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
>
>
>Eve Maler                                  http://www.xmlgrrl.com/blog
>+1 425 345 6756                         http://www.twitter.com/xmlgrrl
>
>_______________________________________________
>OAuth mailing list
>OAuth@ietf.org
>https://www.ietf.org/mailman/listinfo/oauth
>
>
>