Re: [oauth] Updated Charter Text

[Blaine Cook <[e-mail]>]

On Wed, Feb 18, 2009 at 1:47 PM, Tschofenig, Hannes (NSN - FI/Espoo)
<[e-mail]> wrote:
> Hi Stephen,
>
> you are a tough negotiator :-)
>
> I think Blaine tried to capture it with the following bullet:
> "
> * Alternate token exchange profiles.
> "

Correct ;-) There are a few other approaches to exchanging tokens that
may be useful in different contexts, and I don't want to close the
door on those if people care about them. I absolutely consider the
mobile/challenged device use case as critical to address either in the
core spec or, if that's not possible, as an alternate token exchange
profile.

> Would adding something like the sentence below make you happier?
>
> "
> For example, profiles that take challenged devices and aggregators into
> account allowing for the client to directly acquire an access token from
> a set of credentials.
> "

I'm weary about being too specific. I appreciate that there is an I-D,
but there are also several OAuth extension specs that are well
documented and in active use in the wild, but do not have specific
attention in the charter. I also worry that we haven't properly
evaluated the case history nor have we attempted to outline what other
approaches are possible and discuss the various trade-offs. Committing
to a single profile and use case without a proper discussion and clear
consensus seems backwards to me.

My current feeling on the matter is that we have a charter which
provides ample room for discussion and implementation of the
accesstoken-creds I-D, without explicitly committing to it (which is
something I'm personally not prepared to do, and my impression is that
few are or will be until we have the core OAuth work complete).

b.