Re: [OAUTH-WG] AD review of draft-ietf-oauth-native-apps
Adrian Imach <adrianimach@hotmail.com> Thu, 18 May 2017 19:04 UTC
Return-Path: <adrianimach@hotmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F9AC129488 for <oauth@ietfa.amsl.com>; Thu, 18 May 2017 12:04:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.145
X-Spam-Level:
X-Spam-Status: No, score=-0.145 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FORGED_HOTMAIL_RCVD2=0.874, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=hotmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5kAoId1TLzI1 for <oauth@ietfa.amsl.com>; Thu, 18 May 2017 12:04:04 -0700 (PDT)
Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-oln040092069097.outbound.protection.outlook.com [40.92.69.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03667129B1E for <oauth@ietf.org>; Thu, 18 May 2017 11:58:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=n1bHFEj1Wu7QDjrGFSeuB70y2pZXY4KEwcE7fkqHxPw=; b=ZVOHrfh/U6yd78PUSstDEt9vuMBlykUQPxMOT+h9dBcpeSb+izAL5XY39xoE0X32r8iM3TadrudDkuJ2Q6p2ozHVLjcPcJ9EAdtS9J92Pqpv8yEk+Gha0h5/9mN+2/s4m/4S23c7RpMvudFLrYgUYoqAOurTcaVJ8wWSgeEwwTe1tfZyLLXX1D3sFlhOXmc4608fAZEEp+5MV9K5RPLPoQvTSTgidZ8kV0IlpZsgkOoAC9dZL4bGJkKCvwJr8d5nef5PhPszJildCHHrFKJmdFId+47Ewa53SPs4El2ZbTyDeLNjshfIZ0E8mjYB6py5nWLnnI9NB4MN/WNqjuRrsA==
Received: from HE1EUR02FT047.eop-EUR02.prod.protection.outlook.com (10.152.10.60) by HE1EUR02HT160.eop-EUR02.prod.protection.outlook.com (10.152.11.89) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1075.5; Thu, 18 May 2017 18:58:30 +0000
Received: from AM4PR09MB0627.eurprd09.prod.outlook.com (10.152.10.54) by HE1EUR02FT047.mail.protection.outlook.com (10.152.11.37) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1075.5 via Frontend Transport; Thu, 18 May 2017 18:58:30 +0000
Received: from AM4PR09MB0627.eurprd09.prod.outlook.com ([fe80::b562:3:99a7:9530]) by AM4PR09MB0627.eurprd09.prod.outlook.com ([fe80::b562:3:99a7:9530%14]) with mapi id 15.01.1084.030; Thu, 18 May 2017 18:58:30 +0000
From: Adrian Imach <adrianimach@hotmail.com>
To: John Bradley <ve7jtb@ve7jtb.com>
CC: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, William Denniss <wdenniss@google.com>, "oauth@ietf.org" <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] AD review of draft-ietf-oauth-native-apps
Thread-Index: AQHS0AKqdkdgJQJ8CEq0ZYjKm3dLJaH6brEAgAACwf4=
Date: Thu, 18 May 2017 18:58:29 +0000
Message-ID: <AM4PR09MB0627D050138C01F0CB408DBAB0E40@AM4PR09MB0627.eurprd09.prod.outlook.com>
References: <CAHbuEH5Pa2-K7Y+w0neyVOLBxn4XfZifiNfc6rvgAVN5nBZGpw@mail.gmail.com> <CAAP42hCC2w1NXKnx8BX5dGY5jec_XPt39_2=Pi=-0HGznOZROg@mail.gmail.com> <CAHbuEH4Hn-z1d2xssGLGzTY-8FYkwZch=Cf53ch51H4wg6aseQ@mail.gmail.com>, <CAHbuEH7Zn9tGNS57Z4rYLFqPqbQuXf9z7B0n2voUsFawHVNZFw@mail.gmail.com>, <MWHPR19MB108559BA79F3460C01F54E40FAE40@MWHPR19MB1085.namprd19.prod.outlook.com>
In-Reply-To: <MWHPR19MB108559BA79F3460C01F54E40FAE40@MWHPR19MB1085.namprd19.prod.outlook.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: ve7jtb.com; dkim=none (message not signed) header.d=none;ve7jtb.com; dmarc=none action=none header.from=hotmail.com;
x-incomingtopheadermarker: OriginalChecksum:D12048D0F44B4DFF956AFF2913D115064146C6894E7CB7926A3EB841FBE3FCE8; UpperCasedChecksum:DFE4D84004207BC76728DB66657DB97257F8F639B137636B42BB6D4ADDE25441; SizeAsReceived:8707; Count:46
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [ELJfNLiP02BxQqoHVbwQeGO1iGyjqahB]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; HE1EUR02HT160; 5:B4wGzCSpiEESIUJ/z6xPLqcdyNMh1/IKoygoY8GKwoyZd8pwqneyxXIVt61kORL02ir9TyjoxSNjdIcjVCP3xlY4v5j9dMRTziXknQBo8cI1O39pleelMi3I43tlriNseJXsb+CmlsBW2CKJsNU33Q==; 24:pBGtgneizKzZulu797AoIj1s5Ol0bCfiwE9JDrLV8i8wE7C7GfVpOKrLA6fkj0wdutYUH7dIuPfVH8waakHnuTzRnc0cEmZwNj2o9QjgVEQ=; 7:PQMQyjl9qyBSL0SkiZZccNOBK+c1haJlTvHL/ux3GYEV9PsKS6rGD9LSCIZjCOc9JraKwfcDYOfR9pEEncJPgL8eLih89EFRidJfsAY0f9oHEPvvDV9bYm6luFDnwwSxQxahXxAvKSWZYaMd2HvLY6176W8r0cOAnFtyKrx1OZN4a35ic2O5Xb9e04zGdSsYjYSrxd5aJlppWLRYq+/MfT/PhCjnJA/0zC1hOSqkybxqxAcArc1lvfksU2p1XQybcoi/DnGlbAAv/hYiNkbBXs+4NIeks95lb1faiOVbow1mwcijXDZso7im6SA7HL9N
x-incomingheadercount: 46
x-eopattributedmessage: 0
x-forefront-antispam-report: EFV:NLI; SFV:NSPM; SFS:(7070007)(98901004); DIR:OUT; SFP:1901; SCL:1; SRVR:HE1EUR02HT160; H:AM4PR09MB0627.eurprd09.prod.outlook.com; FPR:; SPF:None; LANG:en;
x-ms-office365-filtering-correlation-id: 8d113149-7f70-4a9a-b423-08d49e1fdfba
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(201702061074)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322274)(1601125374)(1603101448)(1701031045); SRVR:HE1EUR02HT160;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(444000031); SRVR:HE1EUR02HT160; BCL:0; PCL:0; RULEID:; SRVR:HE1EUR02HT160;
x-forefront-prvs: 0311124FA9
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_AM4PR09MB0627D050138C01F0CB408DBAB0E40AM4PR09MB0627eurp_"
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 18:58:29.8780 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR02HT160
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/YDQ9MfZW_d6nIKz-_CEqQLnX-WE>
Subject: Re: [OAUTH-WG] AD review of draft-ietf-oauth-native-apps
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 May 2017 19:04:07 -0000
Hi , Can I ask one more time to unsubscribe me from your mailing list. Thank you. Adrian Imach On 18 May 2017, at 19:56, John Bradley <ve7jtb@ve7jtb.com<mailto:ve7jtb@ve7jtb.com>> wrote: William and I just discussed it and the goal is to get a new draft out addressing those comments today or tomorrow. John B. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: Kathleen Moriarty<mailto:kathleen.moriarty.ietf@gmail.com> Sent: May 18, 2017 2:14 PM To: William Denniss<mailto:wdenniss@google.com> Cc: oauth@ietf.org<mailto:oauth@ietf.org> Subject: Re: [OAUTH-WG] AD review of draft-ietf-oauth-native-apps Hi, Will there be a new document posted today/tomorrow to address last call comments/the GenART review? I'd like to add the ballot for the IESG review and telechat next week, , but it would be best on the updated draft to avoid duplicate comments. Thank you, Kathleen On Tue, May 2, 2017 at 2:34 PM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com<mailto:kathleen.moriarty.ietf@gmail.com>> wrote: > Hi William, > > Thank you for making the updates. Just a few notes inline and I'll > kick off IETF last call. > > On Wed, Apr 26, 2017 at 5:50 PM, William Denniss <wdenniss@google.com<mailto:wdenniss@google.com>> wrote: >> Thank you for your review Kathleen. >> >> Version 10 which addresses your comments is out: >> https://tools.ietf.org/html/draft-ietf-oauth-native-apps-10 >> >> Replies inline: >> >> On Mon, Apr 24, 2017 at 6:47 PM, Kathleen Moriarty >> <kathleen.moriarty.ietf@gmail.com<mailto:kathleen.moriarty.ietf@gmail.com>> wrote: >>> >>> Hello, >>> >>> Thanks for taking the time to document this best practice and the >>> implementations in the appendix. I have one comment and a few nits. >>> >>> Security Considerations: >>> I think it would go a long way to organize these as ones that apply to >>> this best practice and ones (8.1 and the example in 8.2) about >>> alternate solutions. This could also be done through some added text, >>> but making this clear would be helpful. Maybe moving 8.1 and 8.2 >>> until after the rest of the sections would be enough and then clearly >>> state the intent of this text. >> >> >> Good idea, I think that will help with the readability a lot. I have moved >> the "Embedded User-Agent" section to the end, and clarified the purpose. >> >> The reason it's included at all, is that OAuth itself documents two ways to >> do native OAuth. This document recommends only one of those ways, and I >> thought that detailing why the other way is no longer best-practice would be >> helpful to readers. > > Great, thank you. >> >>> IANA Section: >>> Just a note - you might get some questions about this, but i do think >>> it's fine to leave that text, although unnecessary. >>> >> >> I think I may have mis-read https://tools.ietf.org/html/rfc5226#section-6.1. >> There is an example of a document that has no IANA actions but still >> provides a justification for why that is the case, but in that example it >> uses a non-IANA registry unlike this BCP. >> >> In our case, we are definitely operating in an IANA-controlled namespace, >> but using a private section of the namespace designed for that purpose. The >> intent was to point out that we are following IANA guidelines correctly. >> Happy to remove it (or indicate that it should be removed during >> publication) if it seems superfluous. >> >> For now, in the latest update I have clearly stated "This document has no >> IANA actions.", but retained the discussion. >> > > Sounds good, thank you! > >>> >>> Nits: >>> Section 5, punctuation >>> OLD: >>> By applying the same principles from the web to native apps, we gain >>> benefits seen on the web like the usability of a single sign-on >>> session, and the security of a separate authentication context. >>> NEW: >>> By applying the same principles from the web to native apps, we gain >>> benefits seen on the web, like the usability of a single sign-on >>> session and the security of a separate authentication context. >> >> >> Fixed. >> >>> >>> The document has text that says 'native app' in some places and 'app' >>> in others, I assume these are used interchangeably? It seems that >>> they are used interchangeably. >> >> >> Yes, they are. In the definition section, "app" is defined as "shorthand for >> native app". Is that OK, or should I revise? > > I missed that, but if it's defined, then you are covered. Thanks. > >> >>> >>> Really nitty: >>> Section 7.2, >>> Since you are still in the example, did you mean URL in the following: >>> >>> Such claimed HTTPS URIs can be used as OAuth redirect URIs. >>> Such claimed HTTPS URLs can be used as OAuth redirect URIs. >> >> >> I have migrated to use URI exclusively, other than 2 references to URL where >> I'm referring to platform-specific naming / colloquialisms. >> >> I also changed instances of "custom URI scheme" to "private-use URI scheme", >> the latter being the terminology used by RFC7595. > > Perfect, thanks. The point in asking was just for other reviews that > will follow. > >> >>> And again in the last paragraph of this section. >>> >>> I'm only asking since you specify URL earlier in this section, so you >>> were more specific for the example and then drop back to URI (which is >>> correct, but wondering if you wanted to continue at the same level of >>> specificity or if there was a reason to just say URI here. >> >> >> I believe this is addressed now. >> >>> Section 8.11 >>> s/uri/URI/ >>> > Thank you. >> >> Fixed. >> >> Best, >> William >> >>> >>> >>> -- >>> >>> Best regards, >>> Kathleen >>> >>> _______________________________________________ >>> OAuth mailing list >>> OAuth@ietf.org<mailto:OAuth@ietf.org> >>> https://www.ietf.org/mailman/listinfo/oauth >> >> > > > > -- > > Best regards, > Kathleen -- Best regards, Kathleen _______________________________________________ OAuth mailing list OAuth@ietf.org<mailto:OAuth@ietf.org> https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list OAuth@ietf.org<mailto:OAuth@ietf.org> https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] AD review of draft-ietf-oauth-native-a… Kathleen Moriarty
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… John Bradley
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… Kathleen Moriarty
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… William Denniss
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… Kathleen Moriarty
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… Kathleen Moriarty
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… John Bradley
- Re: [OAUTH-WG] AD review of draft-ietf-oauth-nati… Adrian Imach