Re: [OAUTH-WG] OAuth WRAP

To clarify the distinctions between OAuth WRAP and OAuth 1.0a, the OAuth
WRAP doc[1] Appendix C states the following:

"OAuth WRAP    requires        the     Authorization   Server  to
 support HTTPS,  OAuth   1.0A    does    not."

This is an important distinction, though I assume it applies only to the
profile(s) supplied as part of WRAP and not to extension profile(s) that may
be created.  E.g., one could create a fourth profile which did not require
HTTPs -- it just would not be as interoperable as the others, and servers
and clients are not required to support it, but it would be otherwise
compatible with WRAP if I understand correctly.)

"The   Access  Token   in      OAuth   WRAP    is      opaque  to      the
  Client. The     Client  does    not     need    to      perform any
cryptography    except  for     calling HTTPS."

This is also important, but what is the difference between WRAP and OAuth
1.0A PLAINTEXT mode?  They seem to be pretty much identical to me, if there
is a difference it should be called out.

"The   Access  Token   in      OAuth   WRAP    can     contain authorization
  information,    or      claims, enabling        the     Protected
Resource        to      determine       the     Client's
 authorization   without querying        any     other   resource."

I don't understand this distinction; this sounds exactly like the OAuth 1.0a
token.  What am I missing?

Best,
John

PS:  Sorry for the munged text, that's what I get when I copy and paste from
the PDF to ASCII, any chance of getting a plain text or HTML version of the
spec?
[1] http://oauth-wrap-wg.googlegroups.com/web/WRAP-v0.9.7.2.pdf

On Tue, Nov 10, 2009 at 9:52 AM, Dick Hardt <Dick.Hardt@microsoft.com>wrote:

> At IIW last week, myself, Biran Eaton from Google and Allen Tom from
> Yahoo! presented what is now called OAuth WRAP
>
> The specs and discussion specific to those documents is at:
>
>        http://groups.google.com/group/oauth-wrap-wg
>
> We plan to submit the document as an I-D next week when I-D submission
> is open again, and for further work to occur in the IETF OAuth WG.
>
> -- Dick
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>

-- 
--
John Panzer / Google
jpanzer@google.com / abstractioneer.org / @jpanzer