Re: [OAUTH-WG] [apps-discuss] Web Finger vs. Simple Web Discovery (SWD)

Gonzalo Salgueiro <gsalguei@cisco.com> Fri, 20 April 2012 06:21 UTC

Return-Path: <gsalguei@cisco.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3BF021F86D6 for <oauth@ietfa.amsl.com>; Thu, 19 Apr 2012 23:21:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.524
X-Spam-Level:
X-Spam-Status: No, score=-10.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WPuvbalhckf9 for <oauth@ietfa.amsl.com>; Thu, 19 Apr 2012 23:21:25 -0700 (PDT)
Received: from av-tac-rtp.cisco.com (hen.cisco.com [64.102.19.198]) by ietfa.amsl.com (Postfix) with ESMTP id 0BA8E21F86D7 for <oauth@ietf.org>; Thu, 19 Apr 2012 23:21:24 -0700 (PDT)
X-TACSUNS: Virus Scanned
Received: from chook.cisco.com (localhost.cisco.com [127.0.0.1]) by av-tac-rtp.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id q3K6LNEB015378 for <oauth@ietf.org>; Fri, 20 Apr 2012 02:21:23 -0400 (EDT)
Received: from rtp-gsalguei-87113.cisco.com (rtp-gsalguei-87113.cisco.com [10.116.61.62]) by chook.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id q3K6LM54006329; Fri, 20 Apr 2012 02:21:22 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v1257)
Content-Type: text/plain; charset="us-ascii"
From: Gonzalo Salgueiro <gsalguei@cisco.com>
In-Reply-To: <4E1F6AAD24975D4BA5B1680429673943664916A0@TK5EX14MBXC284.redmond.corp.microsoft.com>
Date: Fri, 20 Apr 2012 02:21:22 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <9E57926E-068A-484B-8D5B-DADF95DA92B3@cisco.com>
References: <423611CD-8496-4F89-8994-3F837582EB21@gmx.net> <4F8852D0.4020404@cs.tcd.ie> <9452079D1A51524AA5749AD23E0039280EFE8D@exch-mbx901.corp.cloudmark.com> <sjm1unn338j.fsf@mocana.ihtfp.org> <9452079D1A51524AA5749AD23E0039280FACC3@exch-mbx901.corp.cloudmark.com> <4E1F6AAD24975D4BA5B168042967394366490B2A@TK5EX14MBXC284.redmond.corp.microsoft.com> <091401cd1ea3$e159be70$a40d3b50$@packetizer.com> <4E1F6AAD24975D4BA5B1680429673943664915EF@TK5EX14MBXC284.redmond.corp.microsoft.com> <091d01cd1eb7$da2c7ed0$8e857c70$@packetizer.com> <4E1F6AAD24975D4BA5B1680429673943664916A0@TK5EX14MBXC284.redmond.corp.microsoft.com>
To: Mike Jones <Michael.Jones@microsoft.com>
X-Mailer: Apple Mail (2.1257)
X-Mailman-Approved-At: Fri, 20 Apr 2012 06:57:38 -0700
Cc: "oauth@ietf.org" <oauth@ietf.org>, Gonzalo Salgueiro <gsalguei@cisco.com>, 'Apps Discuss' <apps-discuss@ietf.org>
Subject: Re: [OAUTH-WG] [apps-discuss] Web Finger vs. Simple Web Discovery (SWD)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Apr 2012 06:21:28 -0000

Mike - 

I can get behind this approach.

(Note: We already mandated JSON in the current WebFinger spec)

Cheers,

Gonzalo

On Apr 20, 2012, at 1:48 AM, Mike Jones wrote:

> To be clear, making this mandatory would break no clients.  It would require updating some servers, just as requiring JSON would.  This seems like a fair tradeoff when it makes an appreciable difference in user interface latency in some important scenarios.  If you and the other key WebFinger supporters can agree to making "resource" support mandatory and requiring JSON, I believe we may have a path forward.
> 
> 				Cheers,
> 				-- Mike
> 
> -----Original Message-----
> From: Paul E. Jones [mailto:paulej@packetizer.com] 
> Sent: Thursday, April 19, 2012 10:39 PM
> To: Mike Jones; 'Murray S. Kucherawy'; oauth@ietf.org; 'Apps Discuss'
> Subject: RE: [apps-discuss] [OAUTH-WG] Web Finger vs. Simple Web Discovery (SWD)
> 
> That's correct.  We could certainly make it mandatory, but the reason it isn't is to maintain backward compatibility with existing deployments.
> 
> I think we should always think carefully when we decide to make a change that breaks backward-compatibility.  This is one change that would do that.
> 
> Paul
> 
>> -----Original Message-----
>> From: Mike Jones [mailto:Michael.Jones@microsoft.com]
>> Sent: Friday, April 20, 2012 1:10 AM
>> To: Paul E. Jones; 'Murray S. Kucherawy'; oauth@ietf.org; 'Apps Discuss'
>> Subject: RE: [apps-discuss] [OAUTH-WG] Web Finger vs. Simple Web 
>> Discovery
>> (SWD)
>> 
>> Currently, support for the "resource" parameter is optional, as per 
>> the following (correct?):
>> 
>>   Note that support for the "resource" parameter is optional, but
>>   strongly RECOMMENDED for improved performance.  If a server does not
>>   implement the "resource" parameter, then the server's host metadata
>>   processing logic remains unchanged from RFC 6415.
>> 
>> To truly support 1, this would need to be changed to REQUIRED, correct?
>> 
>> 				-- Mike
>> 
>> -----Original Message-----
>> From: Paul E. Jones [mailto:paulej@packetizer.com]
>> Sent: Thursday, April 19, 2012 8:16 PM
>> To: Mike Jones; 'Murray S. Kucherawy'; oauth@ietf.org; 'Apps Discuss'
>> Subject: RE: [apps-discuss] [OAUTH-WG] Web Finger vs. Simple Web 
>> Discovery
>> (SWD)
>> 
>> Mike,
>> 
>>> There are two criteria that I would consider to be essential 
>>> requirements for any resulting general-purpose discovery specification:
>>> 
>>> 1.  Being able to always discover per-user information with a single 
>>> GET (minimizing user interface latency for mobile devices, etc.)
>> 
>> WF can do that.  See:
>> $ curl -v https://packetizer.com/.well-known/\
>>          host-meta.json?resource=acct:paulej@packetizer.com
>> 
>>> 2.  JSON should be required and it should be the only format 
>>> required (simplicity and ease of deployment/adoption)
>> 
>> See the above example.  However, I also support XML with my server.  
>> It took me less than 10 minutes to code up both XML and JSON representations.
>> Once the requested format is determined, the requested URI is 
>> determined, data is pulled from the database, spitting out the desired 
>> format is trivial.
>> 
>> Note, and very important note: supporting both XML and JSON would only 
>> be a server-side requirement.  The client is at liberty to use the 
>> format it prefers.  I would agree that forcing a client to support 
>> both would be unacceptable, but the server?  Nothing to it.
>> 
>>> SWD already meets those requirements.  If the resulting spec meets 
>>> those requirements, it doesn't matter a lot whether we call it 
>>> WebFinger or Simple Web Discovery, but I believe that the 
>>> requirements discussion is probably the most productive one to be 
>>> having at this point - not the starting point document.
>> 
>> I believe WebFinger meets those requirements.  We could debate whether 
>> XML should be supported, but I'll note (again) that it is there in RFC 6415.
>> That document isn't all that old and, frankly, it concerns me that we 
>> would have a strong preference for format A one week and then Format B 
>> the next.
>> We are where we are and I can see reason for asking for JSON, but no 
>> good reason to say we should not allow XML (on the server side).
>> 
>> Paul
>> 
>> 
>> 
> 
> 
> 
> 
> _______________________________________________
> apps-discuss mailing list
> apps-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/apps-discuss
>