[OAUTH-WG] AD Review of draft-ietf-oauth-introspection-07
Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> Sun, 19 April 2015 23:01 UTC
Return-Path: <kathleen.moriarty.ietf@gmail.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E23471A00C0 for <oauth@ietfa.amsl.com>; Sun, 19 Apr 2015 16:01:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cHlqdoSKFfcZ for <oauth@ietfa.amsl.com>; Sun, 19 Apr 2015 16:01:08 -0700 (PDT)
Received: from mail-lb0-x233.google.com (mail-lb0-x233.google.com [IPv6:2a00:1450:4010:c04::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44CC21A00BF for <oauth@ietf.org>; Sun, 19 Apr 2015 16:01:08 -0700 (PDT)
Received: by lbbzk7 with SMTP id zk7so117984259lbb.0 for <oauth@ietf.org>; Sun, 19 Apr 2015 16:01:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=OkZFiW5kBXusDBarUk4IPr5Pm8VM8HXLlvhmDKBeGks=; b=htCE1IzGCnFJYwr/RQT2hLnCM0W6XfR0YI8z0CPph62T1GHrQM9622DYrRzhYV37eH NycUYFoZ9gGvnW1nj4iSGtxVIe9wlRlBWLbnrjLyfhoeG/T2hVtoQrtrwxTpKQiQGeuz S+1ivSJ7TN3lMwRY/BUqOiYf4jztyL5hOOIOv53lzBZ9gqYx3dqxr5p/Tu9cVVHtoUCT imVkgpW3+FiSFzRPvudq1/7qn6jYjkpp21moHgnYYG+63BxDuFxsfrBJBaJGKFThf7Rn aNKg/bETxcylsiVdsOzHLzEbhP4C4qDSSY5qOl5RpZFUFGETl43EMcNfV6d2e7gyC+Fl bSpQ==
MIME-Version: 1.0
X-Received: by 10.152.19.199 with SMTP id h7mr13559722lae.32.1429484466701; Sun, 19 Apr 2015 16:01:06 -0700 (PDT)
Received: by 10.112.11.199 with HTTP; Sun, 19 Apr 2015 16:01:06 -0700 (PDT)
Date: Sun, 19 Apr 2015 19:01:06 -0400
Message-ID: <CAHbuEH6=036uX5O_kaRJ5zTZneEqDXkF8UUuPxT6UosMfjZYaw@mail.gmail.com>
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
To: "oauth@ietf.org" <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="089e014942aad98a6d05141bc939"
Archived-At: <http://mailarchive.ietf.org/arch/msg/oauth/lsQTRmNrFMVoKCafdYN3mN5aLyM>
Subject: [OAUTH-WG] AD Review of draft-ietf-oauth-introspection-07
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Apr 2015 23:01:10 -0000
Hello, Thank you for your work on draft-ietf-oauth-introspection-07. The security considerations appear to be addressed well and I was glad to see how a response is handled when the response code is false, to not reveal information as to why. The privacy considerations look good, but I do have another question that should be addressed in the draft in regard to privacy. Section 2.1 says an IP address (or something else) might be used to provide context of the query, the authorization server could have other information about the client. It would be good to mention privacy related considerations for the client in this case in addition to what gets returned in the Introspection Response (already covered). Thank you. -- Best regards, Kathleen
- [OAUTH-WG] AD Review of draft-ietf-oauth-introspe… Kathleen Moriarty
- Re: [OAUTH-WG] AD Review of draft-ietf-oauth-intr… Justin Richer
- Re: [OAUTH-WG] AD Review of draft-ietf-oauth-intr… Kathleen Moriarty