Re: [OAUTH-WG] AD review of draft-ietf-oauth-urn-sub-ns-02

I agree that this should be standards track.

I agree that RFC Required is severe overkill.  Specification required or expert review would be fine.

I believe that we should delete the "please assign" functionality and require the registration to include the URN.  The defining specification should contain the URI to be registered.

I also agree that we need the "Specification document(s)" section of the template.  Authors, possibly see http://tools.ietf.org/html/draft-ietf-oauth-v2-28#section-11.1.1 for example wording to use.

The template is also missing the standard "Change controller" section.

Per your question (5) Stephen, possibly see the registrations in http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-12#section-6.  Authors, maybe using one of these as an example would help?

				-- Mike

-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Peter Saint-Andre
Sent: Wednesday, June 20, 2012 5:40 AM
To: Stephen Farrell
Cc: oauth@ietf.org
Subject: Re: [OAUTH-WG] AD review of draft-ietf-oauth-urn-sub-ns-02

On 6/20/12 6:26 AM, Stephen Farrell wrote:
> 
> Hi,
> 
> Many thanks for a nice short document!
> 
> I've a few questions though and suspect that a quick re-spin might be 
> needed, but let's see what the wg think about 'em first.
> 
> (1) Why Informational? Everything else at that level seems to be 
> specified in a standards track or BCP level RFC, and IETF Consensus is 
> required. [1] I think you have to do this as standards track. Did I 
> miss something?
> 
>    [1] http://www.iana.org/assignments/params/params.xml

I think you're right that standards-track makes sense here.

> (2) Do you *really* want RFC or specification required for all 
> registrations?  I don't care, but there is a trend away from that at 
> the moment since its been found to discourage registrations in a lot 
> of cases. Perhaps expert review would be ok?  No trying to push you 
> one way or the other, I just wanted to check.

Expert review seems fine; lighter processes are better here. If folks really want a spec, I'd prefer Specification Required to RFC Required or IETF Review.

> (3) If answer to (2) is yes: Section 5.1 says "Specification Required" 
> but section 3 said "RFC Required" and those differ.
> For example, an OASIS spec would not be ok if you say RFC required. I 
> don't know if you care, but you need to be consistent. (Or else I've 
> misread something;-)
> 
> (4) Isn't the template missing the reference to the RFC or other 
> specification that defines the URN?
> 
> (5) I don't get section 3, sorry;-) Can you give an example of a 
> class:id pair that'd be registered? Asking IANA to generate the id 
> part seems odd.

It's also not clear to me what is meant by "The token URI that identifies the registered component."

Peter

--
Peter Saint-Andre
https://stpeter.im/

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth