Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions

William Mills <wmills@yahoo-inc.com> Mon, 17 October 2011 16:11 UTC

Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E768E21F8D53 for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 09:11:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -16.948
X-Spam-Level:
X-Spam-Status: No, score=-16.948 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dRMFc4-QyQip for <oauth@ietfa.amsl.com>; Mon, 17 Oct 2011 09:11:46 -0700 (PDT)
Received: from nm24-vm3.bullet.mail.ne1.yahoo.com (nm24-vm3.bullet.mail.ne1.yahoo.com [98.138.91.154]) by ietfa.amsl.com (Postfix) with SMTP id 2C57021F8D52 for <oauth@ietf.org>; Mon, 17 Oct 2011 09:11:45 -0700 (PDT)
Received: from [98.138.90.56] by nm24.bullet.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 16:11:35 -0000
Received: from [98.138.88.233] by tm9.bullet.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 16:11:35 -0000
Received: from [127.0.0.1] by omp1033.mail.ne1.yahoo.com with NNFMP; 17 Oct 2011 16:11:35 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 589372.86456.bm@omp1033.mail.ne1.yahoo.com
Received: (qmail 3769 invoked by uid 60001); 17 Oct 2011 16:11:35 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1318867895; bh=wj6hGupAJX/KdolXVXSEtTnK9PaP5He99fS7og3GDmM=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=cAXnOJrxV4iOTaf7reh7+4j3EWSqPcvSqBgBNLtNcv0va7SN28epQXAR4rATkTpKfJHWRZtdlW+Ip6nABFY9jEuqC8SN17QRE9Wmmii4L88F5affQTVrphE94ppSJJxWmNnKfixh+oPPE0lli+9rGT0aXzNIIxnA49tcwdruw0s=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=GB6J4Sq73/tlPcIZGDYXz1rI5Rz5kJMQpHWshw7q7w5OJzn7yg7cQS6KEnlRBZmC+E1KioyCFn1Is0RBDm8rzQQwNSbqkJjB806eal/ztACWralHNaslfYFzlAPV+FBnfMxAV+L9jCwYEgyoiFoZe8KN4+FkxX98L61xWhEMNXM=;
X-YMail-OSG: 1_rf_X4VM1n39l_NTw8Cu3eAmgWIC_nmjH8N1YtUUzvLjHt oUsX4moM.qErQZWOkmm.K9Rt.D_w2M43ZwyF4pSCAYbF_3TKHis19OyV5tV_ rkDyWFxYvKgxq0qHRrOyx3Raim5__c7mfBVapGbUK27YvErP7PyfBuW9IbuS xqCLcoOZ8CTx0c4GWm5H30uF85CnEpgRhRU1zqdsdk3r7yTRPZf5Af9Z757J NGIDp6DYXUN6JPxJAYhauG9X_NNCGAKtFL4Si7Vz2kLg8nB56Gb4Y4DrTMZL _dzolWN7wENPa6o7xnzu.5CWJxd8UTyo.hOpNJ5EaZoDzxs7Qcp6UogVtjEi THGP2XRF5g6PSAR.H_GAzePq_2BOJzG3T9VxEhYRqkTOOezYr9AMnvg1XQul coFxddbyzpnjs0VfQoIqU6Ux57Q0YYAwTQQ--
Received: from [209.131.62.115] by web31802.mail.mud.yahoo.com via HTTP; Mon, 17 Oct 2011 09:11:34 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.115.325013
References: <4E1F6AAD24975D4BA5B16804296739435C23C5A6@TK5EX14MBXC284.redmond.corp.microsoft.com><7A22B287-CC99-4FD7-84DF-8FF5DA871FC6@gmx.net><4E1F6AAD24975D4BA5B16804296739435C23CAFE@TK5EX14MBXC284.redmond.corp.microsoft.com><89BE3D9D-AB1D-44B2-BA7D-0C0D74BCA885@gmx.net> <4E1F6AAD24975D4BA5B16804296739435C23CC9D@TK5EX14MBXC284.redmond.corp.microsoft.com> <999913AB42CC9341B05A99BBF358718DAABC44@FIESEXC035.nsn-intra.net> <4E1F6AAD24975D4BA5B16804296739435C23EA6A@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9AB561.5060904@gmx.de> <4E1F6AAD24975D4BA5B16804296739435C23F5B6@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9B1BA6.2060704@gmx.de> <90C41DD21FB7C64BB94121FBBC2E723452604B908A@P3PW5EX1MB01.EX1.SECURESERVER.NET>, <9E5660BC-C797-454B-B2AF-48AB3E886AC7@ve7jtb.com> <B33BFB58CCC8BE4998958016839DE27EA769@IMCMBX01.MITRE.ORG> <62D2DE5D-AEBE-4A75-9C36-7A51E63DC7C3@ve7jtb.com> <90C41DD21FB7C64BB94121FBBC2E723452604B9102@P3PW5EX1MB01.EX1.SECURESERVER.NET>
Message-ID: <1318867894.30512.YahooMailNeo@web31802.mail.mud.yahoo.com>
Date: Mon, 17 Oct 2011 09:11:34 -0700 (PDT)
From: William Mills <wmills@yahoo-inc.com>
To: Eran Hammer-Lahav <eran@hueniverse.com>, John Bradley <ve7jtb@ve7jtb.com>, "Richer, Justin P." <jricher@mitre.org>
In-Reply-To: <90C41DD21FB7C64BB94121FBBC2E723452604B9102@P3PW5EX1MB01.EX1.SECURESERVER.NET>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-2139641421-1318867894=:30512"
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Oct 2011 16:11:57 -0000

What's the current leaning in the core spec.  Is there a direction emerging for this answer?



________________________________
From: Eran Hammer-Lahav <eran@hueniverse.com>
To: John Bradley <ve7jtb@ve7jtb.com>om>; "Richer, Justin P." <jricher@mitre.org>
Cc: OAuth WG <oauth@ietf.org>
Sent: Monday, October 17, 2011 7:27 AM
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions

I agree.

EHL

> -----Original Message-----
> From: John Bradley [mailto:ve7jtb@ve7jtb.com]
> Sent: Monday, October 17, 2011 6:07 AM
> To: Richer, Justin P.
> Cc: Eran Hammer-Lahav; OAuth WG
> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
> Proposed Resolutions
> 
> The scopes cross all of the profiles.
> 
> I expect that restricting the character sets for bearer tokens, MAC, and other
> future variants should be dealt with in those profiles.
> 
> Without restricting scope in core, we leave the possibility of coming up with
> different rules in different profiles e.g. MAC vs Bearer.
> 
> It is probably best to have one rule in core that works across all the profiles.
> 
> John B.
> On 2011-10-16, at 7:19 PM, Richer, Justin P. wrote:
> 
> > I think the limit makes sense, but then are tokens limited by the same
> rules? They need to live in all the same places (query parameters, headers,
> forms) that scopes do and would be subject to the same kinds of encoding
> woes that scopes will. Or am I missing something obvious as to why this isn't
> a problem for tokens (both bearer tokens and the public part of MAC tokens)
> but is a problem for scope strings?
> >
> > -- Justin
> > ________________________________________
> > From: oauth-bounces@ietf.org [oauth-bounces@ietf.org] on behalf of
> > John Bradley [ve7jtb@ve7jtb.com]
> > Sent: Sunday, October 16, 2011 8:11 PM
> > To: Eran Hammer-Lahav
> > Cc: OAuth WG
> > Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
> Proposed Resolutions
> >
> > Restricting it now in the core spec is going to save a lot of headaches later.
> >
> > John B.
> > On 2011-10-16, at 3:54 PM, Eran Hammer-Lahav wrote:
> >
> >> It's an open question for the list.
> >>
> >> EHL
> >>
> >>> -----Original Message-----
> >>> From: Julian Reschke [mailto:julian.reschke@gmx.de]
> >>> Sent: Sunday, October 16, 2011 11:00 AM
> >>> To: Mike Jones
> >>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); Hannes Tschofenig; OAuth
> >>> WG; Eran Hammer-Lahav
> >>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues &
> >>> Proposed Resolutions
> >>>
> >>> On 2011-10-16 18:44, Mike Jones wrote:
> >>>> As Eran wrote on 9/30, "The fact that the v2 spec allows a wide
> >>>> range of
> >>> characters in scope was unintentional. The design was limited to
> >>> allow simple ASCII strings and URIs."
> >>>> ...
> >>>
> >>> I see. Thanks.
> >>>
> >>> Is this going to be clarified in -23?
> >>>
> >>> Best regards, Julian
> >> _______________________________________________
> >> OAuth mailing list
> >> OAuth@ietf.org
> >> https://www.ietf.org/mailman/listinfo/oauth
> >
> > _______________________________________________
> > OAuth mailing list
> > OAuth@ietf.org
> > https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth