Re: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt
Mike Jones <Michael.Jones@microsoft.com> Fri, 22 November 2019 08:50 UTC
Return-Path: <Michael.Jones@microsoft.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 995C6120804 for <oauth@ietfa.amsl.com>; Fri, 22 Nov 2019 00:50:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pGLnUAJxzLDL for <oauth@ietfa.amsl.com>; Fri, 22 Nov 2019 00:50:14 -0800 (PST)
Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640132.outbound.protection.outlook.com [40.107.64.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 989A712018B for <oauth@ietf.org>; Fri, 22 Nov 2019 00:50:14 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UJzB6aBJwZA9VFecn8hizybRV1cdaLjtvrWW4WazVGI3Kz0s3OxhNxxOmXDgZDfPLdrTrQ0S/ohR268QRpMx2RSsnpZ/N4DHRFxZ3fbcv6B0bAAWFSmcd+t0wIagCy1vIJzQi6VnyRB7dnOJMK2AfjQD6k565/ND5OQ5nBeAze061HLZGuJN/GON2dNaGKjypNetMgwCmVHvLA7pRZ7FpESJDj7psOa3LXp3vrBJkHL1nxlaxgVA6lMgDI90kQYLRnQBfsF5wHxbZt+v2Cn5luV9hJMPFcAP+eWv4mdsj/mkeDcMXmyfNwPcc2p2xiRFd2O/sSypN3WAda82q4gbMA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ajJc5fggUDT2OVisHfs5ukjugEK6vO/KjXhHj/u6ZgQ=; b=DelQ3ilFSshcgCnuASPB1l5CfprZIRVKeiANgS9y4f2nmNpSM3H8eXSffn1yUHCln+5M8ZKPTK2XNLK9qHS/vpnBP7dwsa0d0vFpixWcZBNKu5F4x59gDWvZINuC4fF9wFFDWHvF6/xup6pUm0hUie2bJA7D9TzVXgOOb9ED3YCvwhkbVD9waD+/Y4x0QvvkYMzBh1OAXYvm41qMDDrE5fSyNjDzPC4FjjvdPZUugzjLqOs4E0KS+1a/rVdihsZXwD/OHZgD0kmguZNFIX2PwuquggfJccs4UWRIXRa+IeJVnG4G7ZY91KL8Ei9MthuOs24PIiU75TyYhD3GqEBzXQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ajJc5fggUDT2OVisHfs5ukjugEK6vO/KjXhHj/u6ZgQ=; b=dFHW0ZclfwKCMGvIt+gH/HfS4taQvoPQStD68DLTUBzYQghHPVkQepqnEuKECRgPBMQGrZRMqsRjLdCghcCbQ9ITlklJGJioo5Xz8bmcW1/mmAIk1zs7no6FGgyO2mXoYLbS92MlGLP4cW+XbI76ySf4cV0wClkRA9cd8mpuDB4=
Received: from BYAPR00MB0567.namprd00.prod.outlook.com (20.179.56.25) by BYAPR00MB0455.namprd00.prod.outlook.com (20.178.52.220) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2511.0; Fri, 22 Nov 2019 08:50:11 +0000
Received: from BYAPR00MB0567.namprd00.prod.outlook.com ([fe80::501c:9720:3c93:15f2]) by BYAPR00MB0567.namprd00.prod.outlook.com ([fe80::501c:9720:3c93:15f2%3]) with mapi id 15.20.2511.000; Fri, 22 Nov 2019 08:50:11 +0000
From: Mike Jones <Michael.Jones@microsoft.com>
To: Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org>, Rob Otto <robotto=40pingidentity.com@dmarc.ietf.org>
CC: oauth <oauth@ietf.org>
Thread-Topic: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt
Thread-Index: AQHVoRHZZf3Z3AdmhU60T9ezfwot0Q==
Date: Fri, 22 Nov 2019 08:50:11 +0000
Message-ID: <BYAPR00MB05674C455BCBA825BA6C906DF5490@BYAPR00MB0567.namprd00.prod.outlook.com>
References: <2EF412B8-AF8C-4642-9BE0-1B528B0C63D5@amazon.com> <288343F2-ACF0-43E0-8577-26AF45330E5C@forgerock.com> <CAD9ie-u_SM+1hRuBWR7zBGSi4Ex59Ht0SzoVTeFuWTRc3cFJXw@mail.gmail.com> <6DECA422-AACC-4DAA-8CD2-FF57CE02DE3E@mit.edu> <CABh6VRHoBqbQAe4U8UxXodCc8oOpOb=GRb_82gT6X9H5rp0n8Q@mail.gmail.com> <1119B3F6-01A0-4885-A352-5C719A7CDE2C@lodderstedt.net> <CABh6VRG7nZ0JhX8u8OM6cxR_2m6ZebbkCDPd_OzRHvBv2EQtkA@mail.gmail.com>, <7590824B-18B6-4896-AD30-1903A86F5F0A@lodderstedt.net>
In-Reply-To: <7590824B-18B6-4896-AD30-1903A86F5F0A@lodderstedt.net>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-11-22T08:47:14.8769331Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com;
x-originating-ip: [166.216.158.173]
x-ms-publictraffictype: Email
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 19b2555c-2d76-43fb-45a7-08d76f28fc4f
x-ms-traffictypediagnostic: BYAPR00MB0455:
x-microsoft-antispam-prvs: <BYAPR00MB04559220D5E9FD74FE14A3D7F5490@BYAPR00MB0455.namprd00.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:3173;
x-forefront-prvs: 02296943FF
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(39860400002)(396003)(136003)(366004)(376002)(53754006)(199004)(189003)(51914003)(71200400001)(478600001)(71190400001)(8990500004)(64756008)(66556008)(66446008)(66946007)(76116006)(966005)(81156014)(81166006)(86362001)(8936002)(14454004)(110136005)(99286004)(6246003)(236005)(9686003)(316002)(66476007)(22452003)(4326008)(5660300002)(2906002)(446003)(54896002)(6306002)(6116002)(6436002)(76176011)(7696005)(52536014)(55016002)(102836004)(10090500001)(15650500001)(53546011)(6506007)(14444005)(256004)(5024004)(7736002)(10290500003)(74316002)(66574012)(8676002)(66066001)(606006)(26005)(229853002)(186003)(25786009)(33656002)(11346002)(3846002); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR00MB0455; H:BYAPR00MB0567.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: /0GhRcWYNIhU0J/gl7wz3q8Vmsl9GQjWdejz4xc+I0uZ7sRaqDkfY2UHcuUj3KddXteGPuSvguE8uLIGPm4xjTxdoDNrYtQaitQkxonk8v00Eb+Ji1FYTLoGEhMZXlWke7LNEqSNDfH79wSahpJJeogqrxickpo4GCsUyY0q+BAm2ZBQggKuRnMipKN+fl4/0IfcL6IYtxy+YstZ7Zc5zzAUvgzsT545lgBoAatm71gQhLhZ1MAJNbZGBt/uA0lDkTAjrmRmDNiCPaHQstQDBYnbYnhggZEcq4coeMtV5OD93S0avubTM+23xHaiKNyAzBAaCYBiaxRJDBrwqhYIa89M1lRXyzeJwc9AXFu1IFN1n/THTzsfETxwTQccPzQmTfYJhzVxBcP/BxYJ0gDIs2PCSlLat9SBQGudPtWawn67QHlwnkRH5VgJBkjExJEJC6lKqBqQTKBJIFr4+SPq5vnHRwLHipgi6z8QdfWklU8=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_BYAPR00MB05674C455BCBA825BA6C906DF5490BYAPR00MB0567namp_"
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 19b2555c-2d76-43fb-45a7-08d76f28fc4f
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Nov 2019 08:50:11.7613 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: pMqWfDwGfmiIwNEgnArUXp7dJWfTpu6SgN1g42bfMFXlOkxmFD4eGNJAlCp5+g35ni2eC2emJ5bpAJjWclYP0g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR00MB0455
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/wqxU6mKfQFM_CWFxX_bNb4SU4EE>
Subject: Re: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Nov 2019 08:50:19 -0000
I hear you about the difference between Web apps and native apps, Torsten. But using different mechanisms for different application types is a cost in and of itself. It's good to understand the tradeoffs. -- Mike ________________________________ From: OAuth <oauth-bounces@ietf.org> on behalf of Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org> Sent: Friday, November 22, 2019 4:20:58 PM To: Rob Otto <robotto=40pingidentity.com@dmarc.ietf.org> Cc: oauth <oauth@ietf.org> Subject: [EXTERNAL] Re: [OAUTH-WG] New Version Notification for draft-fett-oauth-dpop-03.txt Hi Rob, > On 22. Nov 2019, at 16:10, Rob Otto <robotto=40pingidentity.com@dmarc.ietf.org> wrote: > > Hi Torsten - thanks for the reply.. > > Responses in line. > > Grüsse > Rob > > On Fri, 22 Nov 2019 at 07:59, Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org> wrote: > Hi Rob, > > > On 22. Nov 2019, at 15:52, Rob Otto <robotto=40pingidentity.com@dmarc..ietf.org> wrote: > > > > Hi everyone > > > > I'd agree with this. I'm looking at DPOP as an alternative and ultimately simpler way to accomplish what we can already do with MTLS-bound Access Tokens, for use cases such as the ones we address in Open Banking; these are API transactions that demand a high level of assurance and as such we absolutely must have a mechanism to constrain those tokens to the intended bearer. Requiring MTLS across the ecosystem, however, adds significant overhead in terms of infrastructural complexity and is always going to limit the extent to which such a model can scale. > > I would like to unterstand why mTLS adds “significant overhead in terms of infrastructural complexity”. Can you please dig into details? > > I guess it's mostly that every RS-endpoint (or what sits in front of it) has to have a mechanism for accepting/terminating mTLS, managing roots of trust, validating/OCSP, etc You use a PKI then. We use mTLS with self-signed certs. That requires the RS to not check the X.509 trust chain, which requires a special setting (optionalNoCA). > and then passing the certificates downstream as headers. None of it is necessarily difficult or impossible to do in isolation, but I meet many many people every week who simply don't know how to do any of this stuff. And these are typically "network people", for want of a better word. There are quite a few SaaS API management and edge solutions out there that don't even support mTLS at all. You also have the difficulty in handling a combination of MTLS and non-MTLS traffic to the same endpoints. yep. You better split them, especially if that’s a user facing endpoint. > Again, it's possible to do, but far from straightforward. > > > > Our experience so far: It can be a headache to set up in a microservice architecture with TLS terminating proxies but once it runs it’s ok. On the other side, it’s easy to use for client developers and it combines client authentication and sender constraining nicely. > > I do think its an elegant solution, don't get me wrong. It's just that there are plenty of moving parts that you need to get right and that can be a challenge, particularly in large, complex environments. I agree. I also tend there is a tendency to think Client TLS authentication is bad. I understand that from historical and recent experience with PKI. But anybody considering to use a application level signing solution based on _raw_ public keys should directly move towards self-signed certificates. That brings you all the benefits of TLS without the (PKI) headache. > > > > > > > DPOP, to me, appears to be a rather more elegant way of solving the same problem, with the benefit of significantly reducing the complexity of (and dependency on) the transport layer. I would not argue, however, that it is meant to be a solution intended for ubiquitous adoption across all OAuth-protected API traffic. Clients still need to manage private keys under this model and my experience is that there is typically a steep learning curve for developers to negotiate any time you introduce a requirement to hold and use keys within an application. > > My experience is most developer don’t even get the URL right (in the signature and the value used on the receiving end). So the total cost of ownership is increased by numerous support inquiries. > I'll not comment, at the risk of offending developers :) Alright. Ultimately, I just want to get in touch with those who respond :-) best regards, Torsten. > > best regards, > Torsten. > > > > > I guess I'm with Justin - let's look at DPOP as an alternative to MTLS-bound tokens for high-assurance use cases, at least initially, without trying to make it solve every problem. > > > > Best regards > > Rob > > > > > > On Fri, 22 Nov 2019 at 07:24, Justin Richer <jricher@mit.edu> wrote: > > I’m going to +1 Dick and Annabelle’s question about the scope here. That was the one major thing that struck me during the DPoP discussions in Singapore yesterday: we don’t seem to agree on what DPoP is for. Some (including the authors, it seems) see it as a quick point-solution to a specific use case. Others see it as a general PoP mechanism. > > > > If it’s the former, then it should be explicitly tied to one specific set of things. If it’s the latter, then it needs to be expanded. > > > > I’ll repeat what I said at the mic line: My take is that we should explicitly narrow down DPoP so that it does exactly one thing and solves one narrow use case. And for a general solution? Let’s move that discussion into the next major revision of the protocol where we’ll have a bit more running room to figure things out.. > > > > — Justin > > > >> On Nov 22, 2019, at 3:13 PM, Dick Hardt <dick.hardt@gmail.com> wrote: > >> > >> > >> > >> On Fri, Nov 22, 2019 at 3:08 PM Neil Madden <neil.madden@forgerock.com> wrote: > >> On 22 Nov 2019, at 01:42, Richard Backman, Annabelle <richanna@amazon.com> wrote: > >>> There are key distribution challenges with that if you are doing validation at the RS, but validation at the RS using either approach means you’ve lost protection against replay by the RS. This brings us back to a core question: what threats are in scope for DPoP, and in what contexts? > >> > >> Agreed, but validation at the RS is premature optimisation in many cases. And if you do need protection against that the client can even append a confirmation key as a caveat and retrospectively upgrade a bearer token to a pop token. They can even do transfer of ownership by creating copies of the original token bound to other certificates/public keys. > >> > >> While validation at the RS may be an optimization in many cases, it is still a requirement for deployments. > >> > >> I echo Annabelle's last question: what threats are in scope (and out of scope) for DPoP? > >> > >> > >> _______________________________________________ > >> OAuth mailing list > >> OAuth@ietf.org > >> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Foauth&data=02%7C01%7CMichael.Jones%40microsoft.com%7C2ddae7c4050348d9405a08d76f24f315%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637100076834776598&sdata=6x%2Fjtuo2qkObT8bAdMUmkHbvOYr8wZX7pngViwA4e0Q%3D&reserved=0 > > > > _______________________________________________ > > OAuth mailing list > > OAuth@ietf.org > > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Foauth&data=02%7C01%7CMichael.Jones%40microsoft.com%7C2ddae7c4050348d9405a08d76f24f315%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637100076834776598&sdata=6x%2Fjtuo2qkObT8bAdMUmkHbvOYr8wZX7pngViwA4e0Q%3D&reserved=0 > > > > > > -- > > > > Rob Otto > > EMEA Field CTO/Solutions Architect > > robertotto@pingidentity.com > > > > c: +44 (0) 777 135 6092 > > Connect with us: > > > > > > CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you._______________________________________________ > > OAuth mailing list > > OAuth@ietf.org > > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Foauth&data=02%7C01%7CMichael.Jones%40microsoft.com%7C2ddae7c4050348d9405a08d76f24f315%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637100076834776598&sdata=6x%2Fjtuo2qkObT8bAdMUmkHbvOYr8wZX7pngViwA4e0Q%3D&reserved=0 > > > > -- > > Rob Otto > EMEA Field CTO/Solutions Architect > robertotto@pingidentity.com > > c: +44 (0) 777 135 6092 > Connect with us: > > > CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited.. If you have received this communication in error, please notify the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- [OAUTH-WG] Fwd: New Version Notification for draf… Brian Campbell
- Re: [OAUTH-WG] Fwd: New Version Notification for … Denis
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Paul Querna
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… David Waite
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Dick Hardt
- Re: [OAUTH-WG] New Version Notification for draft… Justin Richer
- Re: [OAUTH-WG] New Version Notification for draft… Rob Otto
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Mike Jones
- Re: [OAUTH-WG] New Version Notification for draft… Filip Skokan
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Rob Otto
- Re: [OAUTH-WG] New Version Notification for draft… Filip Skokan
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Mike Jones
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Dick Hardt
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Aaron Parecki
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Petteri Stenius
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Jim Manico
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Dave Tonge
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Jared Jennings
- Re: [OAUTH-WG] New Version Notification for draft… Aaron Parecki
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Brian Campbell
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Richard Backman, Annabelle
- Re: [OAUTH-WG] New Version Notification for draft… Neil Madden
- Re: [OAUTH-WG] New Version Notification for draft… Torsten Lodderstedt
- Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: New Versio… Richard Backman, Annabelle
- Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: New Versio… Rifaat Shekh-Yusef
- Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: [UNVERIFIE… Richard Backman, Annabelle
- Re: [OAUTH-WG] [UNVERIFIED SENDER] Re: [UNVERIFIE… Rifaat Shekh-Yusef