Re: [OAUTH-WG] Opsdir last call review of draft-ietf-oauth-device-flow-10

William Denniss <wdenniss@google.com> Thu, 02 August 2018 21:42 UTC

MIME-Version: 1.0
In-Reply-To: <152880273680.9205.1844934984494262436@ietfa.amsl.com>
References: <152880273680.9205.1844934984494262436@ietfa.amsl.com>
From: William Denniss <wdenniss@google.com>
Date: Thu, 02 Aug 2018 14:41:56 -0700
Message-ID: <CAAP42hC4GL2OGoMXSPPo4_4-VZbqfECgH6N+Rb=0mrfrrZ+A7A@mail.gmail.com>
To: Qin Wu <bill.wu@huawei.com>
Cc: ops-dir@ietf.org, draft-ietf-oauth-device-flow.all@ietf.org, ietf@ietf.org, oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000005a0ccf05727aafd3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/k4hkVuz4E7evxyI7RvrvcOYV5us>
Subject: Re: [OAUTH-WG] Opsdir last call review of draft-ietf-oauth-device-flow-10
Precedence: list

Qin,

Thank you for your valuable feedback. Version 12 incorporates some of your
feedback. Replies inline:

On Tue, Jun 12, 2018 at 4:25 AM, Qin Wu <bill.wu@huawei.com> wrote:

> Reviewer: Qin Wu
> Review result: Ready
>
> I have reviewed this document as part of the Operational directorate¡¯s
> ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written with the intent of improving the operational aspects
> of
> the IETF drafts. Comments that are not addressed in last call may be
> included
> in AD reviews during the IESG review.  Document editors and WG chairs
> should
> treat these comments just like any other last call comments. Document
> reviewed:
>  draft-ietf-oauth-device-flow
>
> Summary:
> This document defines device flow among browserless and input constrained
> devices, end user at browser and authorization server. This device flow
> allows
> OAuth clients to request user authorization from devices that have an
> Internet
> connection, but don't have an easy input method. This document is well
> written,
> especially security consideration section. I think it is ready for
> publication.
>
> Major issue: None
> Minor issue: Editorial
> Section 3.3.1
> The short name for NFV needs to be expanded, maybe add reference.
> QR code also needs to be expanded.
>

NFC and QR were expanded.


> Section 3.5:
> Who is token endpoint, how token endpoint is related to authorization
> server?
> Would it be great to add some clarification text about this.


This separation is covered in OAuth.

I added a some more references to OAuth 2 in Section 3.1 of version 12.

Could do the same in section 3.5.


> Section 4: Would

it be great to clarify the relationship between
> device_authorization_endpoint
> defined in this document and authorization_endpoint defined in
> draft-ietf-oauth-discovery-10 and explain why authorization_endpoint is not
> sufficient,e.g., draft-ietf-oauth-discovery-10 has already defined
> authorization server metadata value authorization_endpoint, however ¡¡
>
> Some text to clarify the distinction between these two endpoints was added
to Section 3.1

Best,
William

[OAUTH-WG] Opsdir last call review of draft-ietf-… Qin Wu
Re: [OAUTH-WG] Opsdir last call review of draft-i… William Denniss