Re: [OAUTH-WG] Fwd: RFC 7628 on A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth

+1 !

Phil

> On Aug 31, 2015, at 23:24, Hannes Tschofenig <hannes.tschofenig@gmx.net> wrote:
> 
> FYI: Thanks to Bill for the hard work!
> 
> -------- Forwarded Message --------
> Subject: RFC 7628 on A Set of Simple Authentication and Security Layer
> (SASL) Mechanisms for OAuth
> Date: Mon, 31 Aug 2015 21:56:17 -0700 (PDT)
> From: rfc-editor@rfc-editor.org
> Reply-To: ietf@ietf.org
> To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org
> CC: kitten@ietf.org, drafts-update-ref@iana.org, rfc-editor@rfc-editor.org
> 
> A new Request for Comments is now available in online RFC libraries.
> 
> 
>        RFC 7628
> 
>        Title:      A Set of Simple Authentication
>                    and Security Layer (SASL) Mechanisms
>                    for OAuth
>        Author:     W. Mills, T. Showalter, H. Tschofenig
>        Status:     Standards Track
>        Stream:     IETF
>        Date:       August 2015
>        Mailbox:    wmills_92105@yahoo.com,
>                    tjs@psaux.com,
>                    Hannes.Tschofenig@gmx.net
>        Pages:      21
>        Characters: 46408
>        Updates/Obsoletes/SeeAlso:   None
> 
>        I-D Tag:    draft-ietf-kitten-sasl-oauth-23.txt
> 
>        URL:        https://www.rfc-editor.org/info/rfc7628
> 
>        DOI:        http://dx.doi.org/10.17487/RFC7628
> 
> OAuth enables a third-party application to obtain limited access to a
> protected resource, either on behalf of a resource owner by
> orchestrating an approval interaction or by allowing the third-party
> application to obtain access on its own behalf.
> 
> This document defines how an application client uses credentials
> obtained via OAuth over the Simple Authentication and Security Layer
> (SASL) to access a protected resource at a resource server.  Thereby,
> it enables schemes defined within the OAuth framework for
> non-HTTP-based application protocols.
> 
> Clients typically store the user's long-term credential.  This does,
> however, lead to significant security vulnerabilities, for example,
> when such a credential leaks.  A significant benefit of OAuth for
> usage in those clients is that the password is replaced by a shared
> secret with higher entropy, i.e., the token.  Tokens typically
> provide limited access rights and can be managed and revoked
> separately from the user's long-term password.
> 
> This document is a product of the Common Authentication Technology Next
> Generation Working Group of the IETF.
> 
> This is now a Proposed Standard.
> 
> STANDARDS TRACK: This document specifies an Internet Standards Track
> protocol for the Internet community, and requests discussion and suggestions
> for improvements.  Please refer to the current edition of the Official
> Internet Protocol Standards (https://www.rfc-editor.org/standards) for the
> standardization state and status of this protocol.  Distribution of this
> memo is unlimited.
> 
> This announcement is sent to the IETF-Announce and rfc-dist lists.
> To subscribe or unsubscribe, see
>  https://www.ietf.org/mailman/listinfo/ietf-announce
>  https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
> 
> For searching the RFC series, see https://www.rfc-editor.org/search
> For downloading RFCs, see https://www.rfc-editor.org/rfc.html
> 
> Requests for special distribution should be addressed to either the
> author of the RFC in question, or to rfc-editor@rfc-editor.org.  Unless
> specifically noted otherwise on the RFC itself, all RFCs are for
> unlimited distribution.
> 
> 
> The RFC Editor Team
> Association Management Solutions, LLC
> 
> 
> 
> 
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth