Re: [OAUTH-WG] Dynamic Client Registration Conference Call: Thu 22 Aug, 2pm PDT

["Tschofenig, Hannes (NSN - FI/Espoo)" <[e-mail]>]

Hi Eve, 

Thanks for pointing to this document. I took a brief look at the use case section and also followed the link to the original UMA use case page at http://kantarainitiative.org/confluence/display/uma/UMA+Scenarios+and+Use+Cases

The problem with the write-up is that it does not help us in the discussion about these specific design choices for the dynamic client registration protocol since the UMA use cases are more high-level. 

What we would, for example, need (at least I think so) are scenarios at the level of "client generates a client id (instead of AS). What is the motivation? What are the implications for the protocol interaction and for security?"

If someone from the UMA community could provide me with use cases that are focused to help me answer questions like the one above that would be helpful. 

Ciao
Hannes

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of ext Eve Maler
> Sent: Tuesday, August 20, 2013 1:33 AM
> To: Justin Richer
> Cc: oauth mailing list
> Subject: Re: [OAUTH-WG] Dynamic Client Registration Conference Call:
> Thu 22 Aug, 2pm PDT
> 
> Hi folks-- Just a reminder that the first draft the UMA group submitted
> on May 1, 2011 contained extensive requirements and use cases related
> to UMA's various needs for dynamic client registration:
> 
> http://tools.ietf.org/html/draft-hardjono-oauth-dynreg-00
> 
> When there was interest to pick up this draft as a WG work item, it was
> recommended that we excise this content so that the doc wouldn't be so
> specific to our particular usage of OAuth.
> 
> I point this out just to show that the need for dynamic client
> registration isn't limited to OpenID Connect, and that some specific
> use cases have already been floated here.
> 
> FWIW,
> 
> 	Eve
> 
> On 19 Aug 2013, at 8:31 AM, Justin Richer <[e-mail]> wrote:
> 
> > All of this is a good argument to do both, which is what I've been
> saying all along.
> >
> > -- Justin
> >
> > On 08/19/2013 11:33 AM, Phil Hunt wrote:
> >> I do not recall agreement in charter discussions to solving a
> specific case.
> >>
> >> I recall more than one in the re-chartering discussion said dyn reg
> needed major changes to solve their use cases.
> >>
> >> Phil
> >>
> >> On 2013-08-19, at 8:18, Justin Richer <[e-mail]> wrote:
> >>
> >>> Tony, I completely disagree. The proposals that I've seen have
> different means and different end states, and they make different
> assumptions about the relationship between entities and the
> capabilities of all players.
> >>>
> >>> -- Justin
> >>>
> >>> On 08/19/2013 11:15 AM, Anthony Nadalin wrote:
> >>>> There are proposals out there that are trying to solve the same
> problem, but in different ways, so I would not say that they are trying
> to solve different use cases. I do think that we need to make sure that
> whatever proposal we select it needs to have a wide range of use cases
> it solves, not just a single use case as the more solutions this group
> produces the more confused folks will be
> >>>>
> >>>> -----Original Message-----
> >>>> From: [e-mail] [mailto:[e-mail]] On
> Behalf Of Justin Richer
> >>>> Sent: Monday, August 19, 2013 7:27 AM
> >>>> To: Phil Hunt
> >>>> Cc: oauth mailing list
> >>>> Subject: Re: [OAUTH-WG] Dynamic Client Registration Conference
> Call: Thu 22 Aug, 2pm PDT
> >>>>
> >>>> I agree that dynamic registration isn't needed to solve *all* of
> the different use cases. It solves its set of specific problems (and
> does so well, if you ask me), but there are and will always be things
> that it won't work for, and that's fine. That's why I've suggested
> under a separate thread that the other drafts go forward separately and
> that DynReg not be hung up on them. We're fundamentally solving
> different use cases, and there is no magic solution that will solve all
> the problems at once.
> >>>>
> >>>>   -- Justin
> >>>>
> >>>> On 08/18/2013 08:15 PM, Phil Hunt wrote:
> >>>>> I think we should start by reviewing use cases taxonomy.
> >>>>>
> >>>>> Then a discussion on any client_id assumptions and actual
> requirements for each client case. Why is registration needed for each
> case?
> >>>>>
> >>>>> The statement can solve some complication but should be put in
> context of use cases.
> >>>>>
> >>>>> Phil
> >>>>>
> >>>>> On 2013-08-18, at 15:01, Hannes Tschofenig
> <[e-mail]> wrote:
> >>>>>
> >>>>>> -----BEGIN PGP SIGNED MESSAGE-----
> >>>>>> Hash: SHA512
> >>>>>>
> >>>>>> - -----BEGIN PGP SIGNED MESSAGE-----
> >>>>>> Hash: SHA512
> >>>>>>
> >>>>>> Based on your feedback via the poll let us start with August
> 22nd with the first conference call. I will distribute the conference
> call details on Tuesday.
> >>>>>>
> >>>>>> Let us talk about the agenda. There were several items brought
> up in
> >>>>>> discussions, namely
> >>>>>>
> >>>>>> * Software assertions / software statements
> >>>>>>
> >>>>>> We briefly discussed this topic at the IETF OAuth session but we
> may need more time to understand the implications for the current
> dynamic client registration document:
> >>>>>> http://www.ietf.org/proceedings/87/slides/slides-87-oauth-2.pptx
> >>>>>>
> >>>>>> * SCIM vs. current dynamic client registration approach for
> >>>>>> interacting with the client configuration endpoint
> >>>>>>
> >>>>>> In the past we said that it would be fine to have a profile
> defined in SCIM to provide the dynamic client registration for those
> who implement SCIM and want to manage clients also using SCIM. It might,
> however, be useful to compare the two approaches in detail to see what
> the differences are.
> >>>>>>
> >>>>>> * Interactions with the client registration endpoint
> >>>>>>
> >>>>>> Justin added some "life cycle" description to the document to
> motivate some of the design decisions. Maybe we need to discuss those
> in more detail and add further text.
> >>>>>> Additional text could come from the NIST Blue Button / Green
> Button usage.
> >>>>>>
> >>>>>> * Aspects that allow servers to store less / no state
> >>>>>>
> >>>>>> - - From the discussions on the list it was not clear whether
> this is actually accomplishable with the current version of OAuth. We
> could explore this new requirement and try to get a better
> understanding how much this relates to dynamic client registration and
> to what extend it requires changes to the core spec.
> >>>>>>
> >>>>>>
> >>>>>> What would you like to start with? Other topics you would like
> to bring up?
> >>>>>> - -----BEGIN PGP SIGNATURE-----
> >>>>>> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> >>>>>> Comment: GPGTools - http://gpgtools.org
> >>>>>>
> >>>>>> iQEcBAEBCgAGBQJSEULvAAoJEGhJURNOOiAtttEH/Aogg8Q/R/L9/mzU05IQbnze
> >>>>>> AdXB1ZvySkV3jZT4I5shmP7hQr6mc6P6UdvyOrSjrvPlBHen55/oa5z7Cwchd1dk
> >>>>>> dcDUEavbodjnm9SrOs0nKaTvdeZimFSBkGMrfhoTYLXpymP24F9PZgwUXdOcFocF
> >>>>>> OiCs3qDajYaA395DCg5+4mOLQQgDnmy4drlgj2NPv1nMBRDBubzgAhJccwF2BLN9
> >>>>>> IW7MAwTEu7vYT/gwIFzriPkui7gYpf8sAqsnzf/z7FtXbsP8imgOKUlQxzZzeSSP
> >>>>>> QEb6+syyMD9Gt6wxQfWzyl5T0bYLP6DQ+ldZR8yGKCwb+2k3LN6Q8bIpj4mIERI=
> >>>>>> =tkGT
> >>>>>> - -----END PGP SIGNATURE-----
> >>>>>> -----BEGIN PGP SIGNATURE-----
> >>>>>> Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
> >>>>>> Comment: GPGTools - http://gpgtools.org
> >>>>>>
> >>>>>> iQEcBAEBCgAGBQJSEUQfAAoJEGhJURNOOiAt8wkIAI3xgdsWuOB36KLiMLRUG+Zb
> >>>>>> RvYqV+rOH80m7YVJcdOLjQJcpPqOIBdzq/yuNiAaF1uFJCqBn97ZQ/NLXLNGcg8x
> >>>>>> wI/Laz7kP2U4B2trBTMtAf2wsY9uYw4Eh+eOEDKGF6cmkEzrzrlw4q/Sfu6vy181
> >>>>>> VI+kqwzZ+iYX4iL3NYPlkg3rwF4OZ1v3T08Erg2SPrbmNd1TRfJJU8HrYFEJQo1q
> >>>>>> p0RiLjcFFDCEZs0gDr9zliCXllV7J9h2ttqLq8+xwPATDuO6buQdFS9vZQ8t1u36
> >>>>>> a0FIuy3NM8PQbblC3B5WumUjW4kntLV09ytYV8h6S8C/dgFwMqzAwEAeNx1exyE=
> >>>>>> =3qNI
> >>>>>> -----END PGP SIGNATURE-----
> >>>>>> _______________________________________________
> >>>>>> OAuth mailing list
> >>>>>> [e-mail]
> >>>>>> https://www.ietf.org/mailman/listinfo/oauth
> >>>>> _______________________________________________
> >>>>> OAuth mailing list
> >>>>> [e-mail]
> >>>>> https://www.ietf.org/mailman/listinfo/oauth
> >>>> _______________________________________________
> >>>> OAuth mailing list
> >>>> [e-mail]
> >>>> https://www.ietf.org/mailman/listinfo/oauth
> >
> > _______________________________________________
> > OAuth mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/oauth
> 
> 
> Eve Maler                                  http://www.xmlgrrl.com/blog
> [phone]                         http://www.twitter.com/xmlgrrl
> 
> _______________________________________________
> OAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/oauth