Re: [OAUTH-WG] Confirmation: Call for Adoption of "OAuth Token Introspection" as an OAuth Working Group Item

Actually there is both:) There is a JWS that contains an opaque token 
from the partner AS. We "introspect" the opaque token with the partner 
at every JWS validation to ensure the authorization is still valid. This 
is a risk decisions agreed to by both parties. Obviously there are other 
ways to solve that part of the problem.

So even though there is a JWS involved, it doesn't necessarily remove 
the need for introspection.

Thanks,
George

On 7/29/14, 8:16 PM, Mike Jones wrote:
>
> Did you consider standardizing the access token format within that 
> deployment so all the parties that needed to could understand it, 
> rather requiring an extra round trip to an introspection endpoint so 
> as to be able to understand things about it?
>
> I realize that might or might not be practical in some cases, but I 
> haven’t heard that alternative discussed, so I thought I’d bring it up.
>
> I also second Phil’s comment that it would be good to understand the 
> use cases that this is intended to solve before embarking on a 
> particular solution path.
>
> -- Mike
>
> *From:*OAuth [mailto:oauth-bounces@ietf.org] *On Behalf Of *George 
> Fletcher
> *Sent:* Tuesday, July 29, 2014 3:25 PM
> *To:* Phil Hunt; Thomas Broyer
> *Cc:* oauth@ietf.org
> *Subject:* Re: [OAUTH-WG] Confirmation: Call for Adoption of "OAuth 
> Token Introspection" as an OAuth Working Group Item
>
> We also have a use case where the AS is provided by a partner and the 
> RS is provided by AOL. Being able to have a standardized way of 
> validating and getting data about the token from the AS would make our 
> implementation much simpler as we can use the same mechanism for all 
> Authorization Servers and not have to implement one off solutions for 
> each AS.
>
> Thanks,
> George
>
> On 7/28/14, 8:11 PM, Phil Hunt wrote:
>
>     Could we have some discussion on the interop cases?
>
>     Is it driven by scenarios where AS and resource are separate
>     domains? Or may this be only of interest to specific protocols
>     like UMA?
>
>     From a technique principle, the draft is important and sound. I am
>     just not there yet on the reasons for an interoperable standard.
>
>     Phil
>
>
>     On Jul 28, 2014, at 17:00, Thomas Broyer <t.broyer@gmail.com
>     <mailto:t.broyer@gmail.com>> wrote:
>
>         Yes. This spec is of special interest to the platform we're
>         building for http://www.oasis-eu.org/
>
>         On Mon, Jul 28, 2014 at 7:33 PM, Hannes Tschofenig
>         <hannes.tschofenig@gmx.net <mailto:hannes.tschofenig@gmx.net>>
>         wrote:
>
>         Hi all,
>
>         during the IETF #90 OAuth WG meeting, there was strong
>         consensus in
>         adopting the "OAuth Token Introspection"
>         (draft-richer-oauth-introspection-06.txt) specification as an
>         OAuth WG
>         work item.
>
>         We would now like to verify the outcome of this call for
>         adoption on the
>         OAuth WG mailing list. Here is the link to the document:
>         http://datatracker.ietf.org/doc/draft-richer-oauth-introspection/
>
>         If you did not hum at the IETF 90 OAuth WG meeting, and have
>         an opinion
>         as to the suitability of adopting this document as a WG work item,
>         please send mail to the OAuth WG list indicating your opinion
>         (Yes/No).
>
>         The confirmation call for adoption will last until August 10,
>         2014.  If
>         you have issues/edits/comments on the document, please send these
>         comments along to the list in your response to this Call for
>         Adoption.
>
>         Ciao
>         Hannes & Derek
>
>
>         _______________________________________________
>         OAuth mailing list
>         OAuth@ietf.org <mailto:OAuth@ietf.org>
>         https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>         -- 
>         Thomas Broyer
>         /tɔ.ma.bʁwa.je/ <http://xn--nna.ma.xn--bwa-xxb.je/>
>
>         _______________________________________________
>         OAuth mailing list
>         OAuth@ietf.org <mailto:OAuth@ietf.org>
>         https://www.ietf.org/mailman/listinfo/oauth
>
>
>
>
>     _______________________________________________
>
>     OAuth mailing list
>
>     OAuth@ietf.org  <mailto:OAuth@ietf.org>
>
>     https://www.ietf.org/mailman/listinfo/oauth
>

-- 
George Fletcher <http://connect.me/gffletch>

Re: [OAUTH-WG] Confirmation: Call for Adoption of "OAuth Token Introspection" as an OAuth Working Group Item

Attachment: XeC