Re: [OAUTH-WG] Updated Charter to the IESG (this weekend)

Mike Jones <Michael.Jones@microsoft.com> Fri, 13 April 2012 17:10 UTC

Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AADA21F863D for <oauth@ietfa.amsl.com>; Fri, 13 Apr 2012 10:10:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.455
X-Spam-Level:
X-Spam-Status: No, score=-5.455 tagged_above=-999 required=5 tests=[AWL=1.144, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SC3rP43jIXSu for <oauth@ietfa.amsl.com>; Fri, 13 Apr 2012 10:10:51 -0700 (PDT)
Received: from tx2outboundpool.messaging.microsoft.com (tx2ehsobe004.messaging.microsoft.com [65.55.88.14]) by ietfa.amsl.com (Postfix) with ESMTP id 5AF4021F8604 for <oauth@ietf.org>; Fri, 13 Apr 2012 10:10:51 -0700 (PDT)
Received: from mail139-tx2-R.bigfish.com (10.9.14.242) by TX2EHSOBE009.bigfish.com (10.9.40.29) with Microsoft SMTP Server id 14.1.225.23; Fri, 13 Apr 2012 17:10:50 +0000
Received: from mail139-tx2 (localhost [127.0.0.1]) by mail139-tx2-R.bigfish.com (Postfix) with ESMTP id C14012001AD; Fri, 13 Apr 2012 17:10:50 +0000 (UTC)
X-SpamScore: -43
X-BigFish: VS-43(z6caMzbb2dI9371I542M1432N98dK11fbI199bIzz1202hzz1033IL8275dhz2fh2a8h668h839h944hd25h)
X-Forefront-Antispam-Report: CIP:131.107.125.8; KIP:(null); UIP:(null); IPV:NLI; H:TK5EX14MLTC101.redmond.corp.microsoft.com; RD:none; EFVD:NLI
Received-SPF: pass (mail139-tx2: domain of microsoft.com designates 131.107.125.8 as permitted sender) client-ip=131.107.125.8; envelope-from=Michael.Jones@microsoft.com; helo=TK5EX14MLTC101.redmond.corp.microsoft.com ; icrosoft.com ;
Received: from mail139-tx2 (localhost.localdomain [127.0.0.1]) by mail139-tx2 (MessageSwitch) id 1334337048117128_21915; Fri, 13 Apr 2012 17:10:48 +0000 (UTC)
Received: from TX2EHSMHS036.bigfish.com (unknown [10.9.14.237]) by mail139-tx2.bigfish.com (Postfix) with ESMTP id 0AEB64E009B; Fri, 13 Apr 2012 17:10:48 +0000 (UTC)
Received: from TK5EX14MLTC101.redmond.corp.microsoft.com (131.107.125.8) by TX2EHSMHS036.bigfish.com (10.9.99.136) with Microsoft SMTP Server (TLS) id 14.1.225.23; Fri, 13 Apr 2012 17:10:47 +0000
Received: from TK5EX14MBXC283.redmond.corp.microsoft.com ([169.254.2.13]) by TK5EX14MLTC101.redmond.corp.microsoft.com ([157.54.79.178]) with mapi id 14.02.0283.004; Fri, 13 Apr 2012 17:10:30 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Justin Richer <jricher@mitre.org>, Hannes Tschofenig <hannes.tschofenig@gmx.net>
Thread-Topic: [OAUTH-WG] Updated Charter to the IESG (this weekend)
Thread-Index: AQHNGJrBAuQglVZ/R0WeZTzlbF/CnpaY/QCAgAACPMA=
Date: Fri, 13 Apr 2012 17:10:29 +0000
Message-ID: <4E1F6AAD24975D4BA5B1680429673943664668FF@TK5EX14MBXC283.redmond.corp.microsoft.com>
References: <693A5F68-9F51-452C-B684-2A891133F875@gmx.net> <4F885BF9.2080307@mitre.org>
In-Reply-To: <4F885BF9.2080307@mitre.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [157.54.51.35]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
Cc: "oauth@ietf.org WG" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] Updated Charter to the IESG (this weekend)
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 13 Apr 2012 17:10:59 -0000

Yes, there was an explicit decision in that regard.  My sense was that the WG did think they're important but they only wanted to take on a manageable number of tasks at once.

				-- Mike

-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Justin Richer
Sent: Friday, April 13, 2012 10:02 AM
To: Hannes Tschofenig
Cc: oauth@ietf.org WG
Subject: Re: [OAUTH-WG] Updated Charter to the IESG (this weekend)

Did the "Introspection Endpoint" or "Methods for connecting a PR to an AS" get dropped? There seemed to be interest in the list in coming up with a generally applicable scheme, or set of schemes, to do this, and there are certainly no shortage of starting points. Both AOL and Ping have their own token introspection drafts that got put to the list, we've developed our own internal approach here, UMA has an alternative approach, and OpenID Connect has invented its own approach for ID Tokens.

I just want to make sure that this was an explicit decision of it being out of scope here and not an inadvertent omission.

  -- Justin

On 04/12/2012 06:55 AM, Hannes Tschofenig wrote:
> Hey guys
>
> based on the discussion before, during, and after the Paris IETF meeting I am going to send the following updated charter / milestones to the IESG.
> Please have a quick look (till the end of the week) to double-check the content (particularly the suggested milestone dates):
>
> ----------
>
>
> Web Authorization Protocol (oauth)
>
> Description of Working Group
>
> The Web Authorization (OAuth) protocol allows a user to grant a 
> third-party Web site or application access to the user's protected 
> resources, without necessarily revealing their long-term credentials, 
> or even their identity. For example, a photo-sharing site that 
> supports OAuth could allow its users to use a third-party printing Web 
> site to print their private pictures, without allowing the printing 
> site to gain full control of the user's account and without having the 
> user sharing his or her photo-sharing sites' long-term credential with 
> the printing site.
>
> The OAuth protocol suite encompasses
> * a procedure for allowing a client to discover a resource server,
> * a protocol for obtaining authorization tokens from an authorization 
> server with the resource owner's consent,
> * protocols for presenting these authorization tokens to protected 
> resources for access to a resource, and
> * consequently for sharing data in a security and privacy respective way.
>
> In April 2010 the OAuth 1.0 specification, documenting pre-IETF work, 
> was published as an informational document (RFC 5849). With the 
> completion of OAuth 1.0 the working group started their work on OAuth 
> 2.0 to incorporate implementation experience with version 1.0, 
> additional use cases, and various other security, readability, and 
> interoperability improvements. An extensive security analysis was 
> conducted and the result is available as a stand-alone document 
> offering guidance for audiences beyond the community of protocol implementers.
>
> The working group also developed security schemes for presenting 
> authorization tokens to access a protected resource. This led to the 
> publication of the bearer token as well as the message authentication 
> code (MAC) access authentication specification.
>
> OAuth 2.0 added the ability to trade a SAML assertion against an OAUTH 
> token with the SAML 2.0 bearer assertion profile.  This offers 
> interworking with existing identity management solutions, in particular SAML based deployments.
>
> OAuth has enjoyed widespread adoption by the Internet application 
> service provider community. To build on this success we aim for 
> nothing more than to make OAuth the authorization framework of choice 
> for any Internet protocol. Consequently, the ongoing standardization 
> effort within the OAuth working group is focused on enhancing 
> interoperability of OAuth deployments. While the core OAuth 
> specification truly is an important building block it relies on other 
> specifications in order to claim completeness. Luckily, these 
> components already exist and have been deployed on the Internet. Through the IETF standards process they will be improved in quality and will undergo a rigorous review process.
>
> Goals and Milestones
>
> [Editor's Note: Here are the completed items.]
>
> Done  Submit 'OAuth 2.0 Threat Model and Security Considerations' as a 
> working group item Done  Submit 'HTTP Authentication: MAC 
> Authentication' as a working group item Done  Submit 'The OAuth 2.0 
> Protocol: Bearer Tokens' to the IESG for consideration as a Proposed 
> Standard Done  Submit 'The OAuth 2.0 Authorization Protocol' to the 
> IESG for consideration as a Proposed Standard
>
> [Editor's Note: Finishing existing work. Double-check the proposed 
> dates - are they realistic?]
>
> May  2012  Submit 'SAML 2.0 Bearer Assertion Profiles for OAuth 2.0' 
> to the IESG for consideration as a Proposed Standard May  2012  Submit 
> 'OAuth 2.0 Assertion Profile' to the IESG for consideration as a 
> Proposed Standard May  2012  Submit 'An IETF URN Sub-Namespace for 
> OAuth' to the IESG for consideration as a Proposed Standard May  2012  
> Submit 'OAuth 2.0 Threat Model and Security Considerations' to the 
> IESG for consideration as an Informational RFC Dec. 2012  Submit 'HTTP 
> Authentication: MAC Authentication' to the IESG for consideration as a 
> Proposed Standard
>
> [Editor's Note: New work for the group]
>
> Nov. 2012  Submit 'Token Revocation' to the IESG for consideration as 
> a Proposed Standard
>
> [Starting point for the work will be 
> http://datatracker.ietf.org/doc/draft-lodderstedt-oauth-revocation/]
>
> Dec. 2012  Submit 'OAuth Use Cases' to the IESG for consideration as 
> an Informational RFC
>
> [Starting point for the work will be 
> http://tools.ietf.org/html/draft-zeltsan-oauth-use-cases]
>
> Jan. 2013  Submit 'Simple Web Discovery' to the IESG for consideration 
> as a Proposed Standard
>
> [Starting point for the work will be 
> http://tools.ietf.org/html/draft-jones-simple-web-discovery]
>
> Mar. 2013  Submit 'JSON Web Token (JWT)' to the IESG for consideration 
> as a Proposed Standard
>
> [Starting point for the work will be 
> http://tools.ietf.org/html/draft-jones-json-web-token]
>
> Mar. 2013  Submit 'JSON Web Token (JWT) Bearer Token Profiles for 
> OAuth 2.0' to the IESG for consideration as a Proposed Standard
>
> [Starting point for the work will be 
> http://tools.ietf.org/html/draft-jones-oauth-jwt-bearer]
>
> Jul. 2013  Submit 'OAuth Dynamic Client Registration Protocol' to the 
> IESG for consideration as a Proposed Standard
>
> [Starting point for the work will be 
> http://tools.ietf.org/html/draft-hardjono-oauth-dynreg]
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth