Re: [OAUTH-WG] draft-bertocci-oauth-access-token-jwt-00

[Vittorio Bertocci <[e-mail]>]

Hey Benjamin,
Of course I agree that sheer headcount isn’t the main factor :).
The main point here is that this is a profile meant to promote and
facilitate interoperability, so _as long as a proposal is is sound &
secure_, the number of products and services favoring it does have direct
impact on adoption & expectations of successful interop. I agree that the
“why” remains the highest order bit, and as you mentioned we have seen good
arguments.

On Sat, Mar 30, 2019 at 02:15 Benjamin Kaduk <[e-mail]> wrote:

> Hi Vittorio,
>
> On Tue, Mar 26, 2019 at 09:48:08AM -0700, Vittorio Bertocci wrote:
> > thank you Steinar and everyone else for the comments on this!
> > To summarize the situation so far: Dominick, Steinar, Rob, David, Nov,
> > Bertrand recommend using sub only for users. Martin would like to have
> the
> > sub for app only flows as well. Hans is neutral.
> > That does sound like the sub as user has more consensus, tho before
> > changing it I'd wait for the people currently at IETF104 to have more
> time
> > to comment as well.
>
> I'm not the responsible AD for OAuth, but as irresponsible AD let me point
> out that the WG chairs need to look at the "why" and not just the headcount
> of support, when they determine what has consensus (or lack of consensus).
> But I think we have seen some good arguments presented in this thread, so
> hopefully the chairs' job will not be very difficult.
>
> -Ben
>