Re: [OAUTH-WG] Minor questions regarding draft-ietf-oauth-json-web-token-19

Hannes Tschofenig <hannes.tschofenig@gmx.net> Thu, 24 April 2014 09:00 UTC

Return-Path: <hannes.tschofenig@gmx.net>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF0FA1A03E5 for <oauth@ietfa.amsl.com>; Thu, 24 Apr 2014 02:00:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.172
X-Spam-Level:
X-Spam-Status: No, score=-2.172 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WKex2s1Amz87 for <oauth@ietfa.amsl.com>; Thu, 24 Apr 2014 02:00:14 -0700 (PDT)
Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) by ietfa.amsl.com (Postfix) with ESMTP id A6D791A0125 for <oauth@ietf.org>; Thu, 24 Apr 2014 02:00:13 -0700 (PDT)
Received: from [192.168.131.128] ([80.92.122.106]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0MWwp6-1WR6Rz3Ro4-00VyTS; Thu, 24 Apr 2014 11:00:04 +0200
Message-ID: <5358D1C6.1080807@gmx.net>
Date: Thu, 24 Apr 2014 10:56:38 +0200
From: Hannes Tschofenig <hannes.tschofenig@gmx.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: Mike Jones <Michael.Jones@microsoft.com>, "oauth@ietf.org" <oauth@ietf.org>
References: <4E1F6AAD24975D4BA5B16804296739439A191D83@TK5EX14MBXC288.redmond.corp.microsoft.com>
In-Reply-To: <4E1F6AAD24975D4BA5B16804296739439A191D83@TK5EX14MBXC288.redmond.corp.microsoft.com>
X-Enigmail-Version: 1.5.2
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IKUr7xaNpcXVb1JhSFD0JBNgFr9uMiltI"
X-Provags-ID: V03:K0:ds2GOP07ZL/yh4Z2fY4sSXSRtMARYTv2bKmPBM9gtEeGTAL41Hg j9bbPXjM04VG4b11F3P30tjVOTKA3kYCWfaNItDkns4O+MSGoSIbEq25BM/StJEbGybmLMk ya6AfLIU9Dq29VYY7X15vZ0DyprWr7el+3cfA6CUmJbm9oD5P8UoCZzTWABWDzaUwIs+Eeg gMxCRnFrnqvux8U1eSy+Q==
Archived-At: http://mailarchive.ietf.org/arch/msg/oauth/h8NJw0b3W7MAjmhXk7iulbG9nOo
Subject: Re: [OAUTH-WG] Minor questions regarding draft-ietf-oauth-json-web-token-19
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Apr 2014 09:00:15 -0000

Thanks, Mike.

Leave the ECMAScript reference in the document. I indicated it as a
DOWNREF in the my shepherd write-up and that should be fine.

Ciao
Hannes


On 04/23/2014 06:32 PM, Mike Jones wrote:
> Replies inline...
> 
>  
> 
> -----Original Message-----
> From: OAuth [mailto:oauth-bounces@ietf.org] On Behalf Of Hannes Tschofenig
> Sent: Wednesday, April 23, 2014 4:49 AM
> To: oauth@ietf.org
> Subject: [OAUTH-WG] Minor questions regarding
> draft-ietf-oauth-json-web-token-19
> 
>  
> 
> Doing my shepherd write-up I had a few minor questions:
> 
>  
> 
> * Could you move the RFC 6755 reference to the normative reference
> section? Reason: the IANA consideration section depends on the existence
> of the urn:ietf:params:oauth registry.
> 
>  
> 
> OK
> 
>  
> 
> * Could you move the JWK reference to the informative reference section?
> 
> Reason: The JWK is only used in an example and not essential to the
> implementation or understanding of the specification.
> 
>  
> 
> OK
> 
>  
> 
> * Would it be sufficient to reference RFC 7159 instead of the
> [ECMAScript] reference?
> 
>  
> 
> No.  There’s no equivalent to Section 15.12 of ECMAScript about the
> lexically last member name to reference in RFC 7159.  See the usage in
> the first paragraph of
> http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-19#section-4.
> 
>  
> 
> * The document registers 'urn:ietf:params:oauth:token-type' and it is
> used in the "type" header parameter.
> 
>  
> 
> The text, however, states that the value can also be set to jwt. Why
> would someone prefer to use urn:ietf:params:oauth:token-type instead of
> the much shorter jwt value?
> 
>  
> 
> There are use cases, such as using JWTs as tokens in WS-Trust, where a
> URI is needed.
> 
>  
> 
> Ciao
> 
> Hannes
> 
>  
> 
> Thanks for doing this.
> 
>  
> 
>                                                             -- Mike
> 
>  
>