IETF Logo Mail Archive

Re: [OAUTH-WG] more than one assertion?

Brian Campbell <bcampbell@pingidentity.com> Fri, 13 August 2010 20:54 UTC

Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@core3.amsl.com
Delivered-To: oauth@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8DD723A694A for <oauth@core3.amsl.com>; Fri, 13 Aug 2010 13:54:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.847
X-Spam-Level:
X-Spam-Status: No, score=-5.847 tagged_above=-999 required=5 tests=[AWL=0.130, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 05o4PhNBSy2H for <oauth@core3.amsl.com>; Fri, 13 Aug 2010 13:54:58 -0700 (PDT)
Received: from na3sys009aog103.obsmtp.com (na3sys009aog103.obsmtp.com [74.125.149.71]) by core3.amsl.com (Postfix) with SMTP id 59B3D3A6800 for <oauth@ietf.org>; Fri, 13 Aug 2010 13:54:58 -0700 (PDT)
Received: from source ([74.125.82.52]) by na3sys009aob103.postini.com ([74.125.148.12]) with SMTP ID DSNKTGWxRoOTXlEuE7XVDU7q0Erg2AfOAWPC@postini.com; Fri, 13 Aug 2010 13:55:35 PDT
Received: by mail-ww0-f52.google.com with SMTP id 18so2532496wwi.33 for <oauth@ietf.org>; Fri, 13 Aug 2010 13:55:34 -0700 (PDT)
Received: by 10.216.188.20 with SMTP id z20mr119322wem.51.1281732934175; Fri, 13 Aug 2010 13:55:34 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.216.60.136 with HTTP; Fri, 13 Aug 2010 13:55:04 -0700 (PDT)
In-Reply-To: <AANLkTikQc0-yh3B8ikF+VZVoj-h9qt=dR_rKVfHK_x1A@mail.gmail.com>
References: <90C41DD21FB7C64BB94121FBBC2E72343B3F124503@P3PW5EX1MB01.EX1.SECURESERVER.NET> <C8897C4C.B75E%cmortimore@salesforce.com> <AANLkTinbmx+CBJdMrf5vBuV7wqLwWDLP3vA1N2HcUMHL@mail.gmail.com> <AANLkTinsTe9vxrWsXK6p9+bfRRSyZTjb2yW8+=ux5tU_@mail.gmail.com> <AANLkTik0n-ki3d06wr=sAZCzUDq4KQ-Ahy3wwPXagG6S@mail.gmail.com> <AANLkTikQc0-yh3B8ikF+VZVoj-h9qt=dR_rKVfHK_x1A@mail.gmail.com>
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Fri, 13 Aug 2010 14:55:04 -0600
Message-ID: <AANLkTik9GOtMa0AgW1UJcd8vhipBC97c0tY7ua=pq6eX@mail.gmail.com>
To: David Recordon <recordond@gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: oauth <oauth@ietf.org>
Subject: Re: [OAUTH-WG] more than one assertion?
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 13 Aug 2010 20:54:59 -0000

On Thu, Aug 12, 2010 at 2:04 PM, David Recordon <recordond@gmail.com> wrote:
> Given that, would you strongly object to these proposals being written
> in a separate document than the core spec? The device flow is a good
> example of where we're doing this. We really think that it will be
> useful, are working on implementations, but it hasn't yet been proven
> in production.

The assertion flow should stay in core (others have expressed this
opinion as well).  I've got interop tested code built on that that is
about to GA.

As far as the client assertions, I do believe there's real value in
having a clean extension point for stronger forms of client
authentication.  Yaron's proposed language does a pretty good job I
think.  But if it can be done in a simpler way, let's discuss. I'll
probably regret saying this, but what about not using the word
"assertion" for stronger client auth options?  That might help
eliminate some confusion.

v2.46.0 | Report a Bug | By Email | System Status