Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
William Mills <wmills@yahoo-inc.com> Tue, 18 October 2011 16:45 UTC
Return-Path: <wmills@yahoo-inc.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E252121F86F6 for <oauth@ietfa.amsl.com>; Tue, 18 Oct 2011 09:45:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -17.298
X-Spam-Level:
X-Spam-Status: No, score=-17.298 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_DEF_WHITELIST=-15]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oIJwgzkywAjZ for <oauth@ietfa.amsl.com>; Tue, 18 Oct 2011 09:45:53 -0700 (PDT)
Received: from nm21-vm0.bullet.mail.sp2.yahoo.com (nm21-vm0.bullet.mail.sp2.yahoo.com [98.139.91.220]) by ietfa.amsl.com (Postfix) with SMTP id 011A821F8713 for <oauth@ietf.org>; Tue, 18 Oct 2011 09:45:45 -0700 (PDT)
Received: from [98.139.91.63] by nm21.bullet.mail.sp2.yahoo.com with NNFMP; 18 Oct 2011 16:45:45 -0000
Received: from [98.139.91.25] by tm3.bullet.mail.sp2.yahoo.com with NNFMP; 18 Oct 2011 16:45:45 -0000
Received: from [127.0.0.1] by omp1025.mail.sp2.yahoo.com with NNFMP; 18 Oct 2011 16:45:45 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: 880972.6179.bm@omp1025.mail.sp2.yahoo.com
Received: (qmail 18240 invoked by uid 60001); 18 Oct 2011 16:45:45 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo-inc.com; s=ginc1024; t=1318956345; bh=2B8uI+ERrBIGOqMsEtfeFa0xTsUZMW3VUmRUHl/w6sk=; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=I8XchztpUhYrtL/KGcOv2sl7pBRJzkPjuNnsc/neqtoASJtlsjgEHxQN6CnAIKBCcvPByKmYqbJ5X5qLFFCXkp8wGFPv08cxXH6g85eCExWPi9gGt6leW85UJQcz6oEqfXKLaiBHJL13sMRnteL4Os+UekXwMqS0ui7Pr7VB3kQ=
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=ginc1024; d=yahoo-inc.com; h=X-YMail-OSG:Received:X-RocketYMMF:X-Mailer:References:Message-ID:Date:From:Reply-To:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=I9KTYyjAijXIhnyrlEvEfgdM9nqlAHZYUmlSDpm+ecqcjAEToLUTEZb11lTQbxZLJDdUJttH9twKG02xR+jAa1oBclHIvRzrgiTTcNmFedjrwQCijacBh0KBlNa6++yPDSXJQAeO0v4tv7/09msKwM5x9Ik9PiYrtEkTlI30gfM=;
X-YMail-OSG: Lf1V_AkVM1m7hNmRYpBjnSI8F6QzoNy0PrfwdHUTks8Fvfh j0qapHCvfuq5A50FIyKcovrPrOvcwKkuAO7rFt4th84e2VAU9eO8pszzwLCM LLtxPpzcwM82K_PusR2_yofVEoZBKCjkbHLD1_ujhg3_UZGjGK1.k_jteEnO Bs8zpGXhqsHbYlGNRgJxWrE88EmBho4.39ZPLJ2LOxh3FH6k1OUiNEdrLK2C 2hIpV1QpZUCgXRXUOAIOeJmOAy3v5EMNDVdoXIGketdGKUaAXljFTh9VGKRV BzUcLjcdOpD14dxxJHmQ3m38xxCMDFTYXj3FEULspi1Q2PIrtERLJed8MFDu MKfISIr9.p5DAscydRdB6nbIOCO1j_PbPNjdDqgvVNPbDygaDeZZImyBKwXa d.AsGRDveUWU-
Received: from [99.31.212.42] by web31809.mail.mud.yahoo.com via HTTP; Tue, 18 Oct 2011 09:45:45 PDT
X-RocketYMMF: william_john_mills
X-Mailer: YahooMailWebService/0.8.115.325013
References: <4E1F6AAD24975D4BA5B16804296739435C23C5A6@TK5EX14MBXC284.redmond.corp.microsoft.com><7A22B287-CC99-4FD7-84DF-8FF5DA871FC6@gmx.net><4E1F6AAD24975D4BA5B16804296739435C23CAFE@TK5EX14MBXC284.redmond.corp.microsoft.com><89BE3D9D-AB1D-44B2-BA7D-0C0D74BCA885@gmx.net> <4E1F6AAD24975D4BA5B16804296739435C23CC9D@TK5EX14MBXC284.redmond.corp.microsoft.com> <999913AB42CC9341B05A99BBF358718DAABC44@FIESEXC035.nsn-intra.net> <4E1F6AAD24975D4BA5B16804296739435C23EA6A@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9AB561.5060904@gmx.de> <4E1F6AAD24975D4BA5B16804296739435C23F5B6@TK5EX14MBXC284.redmond.corp.microsoft.com> <4E9B1BA6.2060704@gmx.de> <90C41DD21FB7C64BB94121FBBC2E723452604B908A@P3PW5EX1MB01.EX1.SECURESERVER.NET>, <9E5660BC-C797-454B-B2AF-48AB3E886AC7@ve7jtb.com> <B33BFB58CCC8BE4998958016839DE27EA769@IMCMBX01.MITRE.ORG> <62D2DE5D-AEBE-4A75-9C36-7A51E63DC7C3@ve7jtb.com> <90C41DD21FB7C64BB94121FBBC2E723452604B9102@P3PW5EX1MB01.EX1.SECURESERVER.NET> <4DF35A25-989C-4BE4-8ACD-35 20DDB8BDE9@gmx.net> <90C41DD21FB7C64BB94121FBBC2E723452604B9197@P3PW5EX1MB01.EX1.SECURESERVER.NET> <0AE463C6-254C-4776-A6EC-08DBE3F8A7F1@ve7jtb.com> <1318884797.81519.YahooMailNeo@web31813.mail.mud.yahoo.com> <4E1F6AAD24975D4BA5B16804296739435C2479E0@TK5EX14MBXC283.redmond.corp.microsoft.com>
Message-ID: <1318956345.58284.YahooMailNeo@web31809.mail.mud.yahoo.com>
Date: Tue, 18 Oct 2011 09:45:45 -0700
From: William Mills <wmills@yahoo-inc.com>
To: Mike Jones <Michael.Jones@microsoft.com>, John Bradley <ve7jtb@ve7jtb.com>, Eran Hammer-Lahav <eran@hueniverse.com>
In-Reply-To: <4E1F6AAD24975D4BA5B16804296739435C2479E0@TK5EX14MBXC283.redmond.corp.microsoft.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-616203687-1318956345=:58284"
Cc: OAuth WG <oauth@ietf.org>
Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: William Mills <wmills@yahoo-inc.com>
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Oct 2011 16:45:55 -0000
Anyone objecting here? ________________________________ From: Mike Jones <Michael.Jones@microsoft.com> To: William Mills <wmills@yahoo-inc.com>; John Bradley <ve7jtb@ve7jtb.com>; Eran Hammer-Lahav <eran@hueniverse.com> Cc: OAuth WG <oauth@ietf.org> Sent: Monday, October 17, 2011 3:25 PM Subject: RE: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions +1 From:oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of William Mills Sent: Monday, October 17, 2011 1:53 PM To: John Bradley; Eran Hammer-Lahav Cc: OAuth WG Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions +1 ________________________________ From:John Bradley <ve7jtb@ve7jtb.com> To: Eran Hammer-Lahav <eran@hueniverse.com> Cc: OAuth WG <oauth@ietf.org> Sent: Monday, October 17, 2011 12:13 PM Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & Proposed Resolutions +1 On 2011-10-17, at 11:53 AM, Eran Hammer-Lahav wrote: > All I agree with is to limit the scope character-set in the v2 spec to the subset of ASCII allowed in HTTP header quoted-string, excluding " and \ so no escaping is needed, ever. > > EHL > >> -----Original Message----- >> From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net] >> Sent: Monday, October 17, 2011 8:25 AM >> To: Eran Hammer-Lahav >> Cc: Hannes Tschofenig; John Bradley; Richer, Justin P.; OAuth WG >> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >> Proposed Resolutions >> >> It is good that we have an agreement among a few people that more text >> needs to be provided in the core specification on the issue of the scope >> element. >> >> Now, there is still the question of what the text should say. The questions >> from my earlier mails are therefore still applicable and need an answer. >> >> Ciao >> Hannes >> >> On Oct 17, 2011, at 7:27 AM, Eran Hammer-Lahav wrote: >> >>> I agree. >>> >>> EHL >>> >>>> -----Original Message----- >>>> From: John Bradley [mailto:ve7jtb@ve7jtb.com] >>>> Sent: Monday, October 17, 2011 6:07 AM >>>> To: Richer, Justin P. >>>> Cc: Eran Hammer-Lahav; OAuth WG >>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >>>> Proposed Resolutions >>>> >>>> The scopes cross all of the profiles. >>>> >>>> I expect that restricting the character sets for bearer tokens, MAC, >>>> and other future variants should be dealt with in those profiles. >>>> >>>> Without restricting scope in core, we leave the possibility of coming >>>> up with different rules in different profiles e.g. MAC vs Bearer. >>>> >>>> It is probably best to have one rule in core that works across all the >> profiles. >>>> >>>> John B. >>>> On 2011-10-16, at 7:19 PM, Richer, Justin P. wrote: >>>> >>>>> I think the limit makes sense, but then are tokens limited by the >>>>> same >>>> rules? They need to live in all the same places (query parameters, >>>> headers, >>>> forms) that scopes do and would be subject to the same kinds of >>>> encoding woes that scopes will. Or am I missing something obvious as >>>> to why this isn't a problem for tokens (both bearer tokens and the >>>> public part of MAC tokens) but is a problem for scope strings? >>>>> >>>>> -- Justin >>>>> ________________________________________ >>>>> From: oauth-bounces@ietf.org [oauth-bounces@ietf.org] on behalf of >>>>> John Bradley [ve7jtb@ve7jtb.com] >>>>> Sent: Sunday, October 16, 2011 8:11 PM >>>>> To: Eran Hammer-Lahav >>>>> Cc: OAuth WG >>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues & >>>> Proposed Resolutions >>>>> >>>>> Restricting it now in the core spec is going to save a lot of headaches >> later. >>>>> >>>>> John B. >>>>> On 2011-10-16, at 3:54 PM, Eran Hammer-Lahav wrote: >>>>> >>>>>> It's an open question for the list. >>>>>> >>>>>> EHL >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Julian Reschke [mailto:julian.reschke@gmx.de] >>>>>>> Sent: Sunday, October 16, 2011 11:00 AM >>>>>>> To: Mike Jones >>>>>>> Cc: Tschofenig, Hannes (NSN - FI/Espoo); Hannes Tschofenig; OAuth >>>>>>> WG; Eran Hammer-Lahav >>>>>>> Subject: Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Issues >>>>>>> & Proposed Resolutions >>>>>>> >>>>>>> On 2011-10-16 18:44, Mike Jones wrote: >>>>>>>> As Eran wrote on 9/30, "The fact that the v2 spec allows a wide >>>>>>>> range of >>>>>>> characters in scope was unintentional. The design was limited to >>>>>>> allow simple ASCII strings and URIs." >>>>>>>> ... >>>>>>> >>>>>>> I see. Thanks. >>>>>>> >>>>>>> Is this going to be clarified in -23? >>>>>>> >>>>>>> Best regards, Julian >>>>>> _______________________________________________ >>>>>> OAuth mailing list >>>>>> OAuth@ietf.org >>>>>> https://www.ietf.org/mailman/listinfo/oauth >>>>> >>>>> _______________________________________________ >>>>> OAuth mailing list >>>>> OAuth@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/oauth >>> >>> _______________________________________________ >>> OAuth mailing list >>> OAuth@ietf.org >>> https://www.ietf.org/mailman/listinfo/oauth > _______________________________________________ OAuth mailing list OAuth@ietf.org https://www.ietf.org/mailman/listinfo/oauth
- [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Open Is… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Tschofenig, Hannes (NSN - FI/Espoo)
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Richer, Justin P.
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Hannes Tschofenig
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… John Bradley
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Phil Hunt
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer-Lahav
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Marius Scurtescu
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… William Mills
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Julian Reschke
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Mike Jones
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer
- Re: [OAUTH-WG] draft-ietf-oauth-v2-bearer-09: Ope… Eran Hammer