Re: [OAUTH-WG] Clarifying the scope of the OAuth 2.1 spec (Mike Jones)

Lee McGovern <Lee_McGovern@swissre.com> Mon, 16 March 2020 08:46 UTC

IronPort-SDR: 8nVPIpC2pgvL4B0DjBWogZkZc3RO2a2ujemxlO8UQvP9UIF8qyNDIOKLj9vluMLXMA5xJ0PRyx 8nbjQiEWy84fadsiwYNirqW2m4sBujyRUVJvzmJl647IBhPQMOluUJrtV69NdmHQ2H3NAAuGAu ovWiPIJknATDyeEpvwS7ixOuktrxFDVW+XFC7vbnRWV8CHspE6kxrz+bI9IkbXbg1D2mopIzlr wgg8D/2/WjeQYluQWEN3JhpugDQle2qUUt+u23k/bnYq1fP5eRfcKNWnPGRnoaxGbxbFECJaSq wO4=
From: Lee McGovern <Lee_McGovern@swissre.com>
To: "oauth@ietf.org" <oauth@ietf.org>, "Michael.Jones@microsoft.com" <Michael.Jones@microsoft.com>
Thread-Topic: Clarifying the scope of the OAuth 2.1 spec (Mike Jones)
Thread-Index: AdX7bwhOsl5sek/0R2qXY9S8RBoGMA==
Date: Mon, 16 Mar 2020 08:45:50 +0000
Message-ID: <e80f55cb511d4a12bcd109df105b09bf@CHRP5009.corp.gwpnet.com>
Accept-Language: en-US
Content-Language: en-US
msip_labels: MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_Enabled=True; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_SiteId=45597f60-6e37-4be7-acfb-4c9e23b261ea; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_Owner=Lee_McGovern@swissre.com; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_SetDate=2020-03-16T08:45:48.6181217Z; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_Name=Internal; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_Application=Microsoft Azure Information Protection; MSIP_Label_90c2fedb-0da6-4717-8531-d16a1b9930f4_Extended_MSFT_Method=Automatic; Sensitivity=Internal
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [10.62.28.10]
x-rcom-deduphash: 7b28d6cb-c207-4410-a70d-f46f338725bc
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
X-GBS-PROC: 2hq/bq6V77WAjFgw5xSV5ENI29WK7/gjyFVLBCHDMpI=
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/kP-WEcvF-w8DIcfKmzK0nLkGvAo>
Subject: Re: [OAUTH-WG] Clarifying the scope of the OAuth 2.1 spec (Mike Jones)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 16 Mar 2020 08:46:16 -0000

The statement "removing features that are not currently considered to be best practices" is ambiguous and implies that the best practise could be reinterpreted to include the flows that are now being deprecated. Perhaps "removing features that are no longer considered to be best practices" is much clearer

----------------------------------------------------------------------

Message: 1
Date: Sun, 15 Mar 2020 21:34:56 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: "dick.hardt@gmail.com" <dick.hardt@gmail.com>, "aaron@parecki.com"
	<aaron@parecki.com>, "torsten@lodderstedt.net"
	<torsten@lodderstedt.net>
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: [OAUTH-WG] Clarifying the scope of the OAuth 2.1 spec
Message-ID:
	<DM6PR00MB0684B029182673EADC9E0288F5F80@DM6PR00MB0684.namprd00.prod.outlook.com>

Content-Type: text/plain; charset="us-ascii"

The abstract of draft-parecki-oauth-v2-1 concludes with this text:
   This specification replaces and obsoletes the OAuth 2.0 Authorization Framework described in RFC 6749<https://tools.ietf.org/html/rfc6749>.

While accurate, I don't believe that this text captures the full intent of the OAuth 2.1 effort - specifically, to be a recommended subset of OAuth 2.0, rather than to introduce incompatible changes to it.  Therefore, I request that these sentences be added to the abstract, to eliminate confusion in the marketplace that might otherwise arise:

    OAuth 2.1 is a compatible subset of OAuth 2.0, removing features that are not currently considered to be best practices.  By design, it does not introduce any new features to what already exists in the OAuth 2.0 set of protocols.

                                                       Thanks,
                                                       -- Mike

P.S.  I assert that any incompatible changes should be proposed as part of the TxAuth effort and not as part of OAuth 2.1.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailarchive.ietf.org/arch/browse/oauth/attachments/20200315/87ef5f5d/attachment.html>

This e-mail, including attachments, is intended for the person(s) or company named and may contain confidential and/or legally privileged information.

Unauthorized disclosure, copying or use of this information may be unlawful and is prohibited. If you are not the intended recipient, please delete this message and notify the sender.
All incoming and outgoing e-mail messages are stored in the Swiss Re Electronic Message Repository.
If you do not wish the retention of potentially private e-mails by Swiss Re, we strongly advise you not to use the Swiss Re e-mail account for any private, non-business related communications.

Re: [OAUTH-WG] Clarifying the scope of the OAuth … Lee McGovern