Re: [rtcweb] Alexey Melnikov's Discuss on draft-ietf-rtcweb-security-arch-18: (with DISCUSS)

Thanks, Sean.

I have already given Sean this guidance, but for the benefit of others: 
at this point, I am imposing a moratorium on adding any new normative 
dependencies from Cluster 238 documents to any works in progress, 
regardless of their level of maturity.

In this case: if RFC 5785bis completes prior to publication of 
rtcweb-security-arch, the RFC editor will (as a matter of practice) ask 
the authors whether they want to update the reference. If it does not, 
we do not want to block publication of the rest of the cluster on it.

/a

On 3/26/19 11:28, Sean Turner wrote:
>
>> On Mar 7, 2019, at 02:31, Sean Turner <sean@sn3rd.com> wrote:
>>
>>
>>
>>> On Mar 7, 2019, at 04:37, Adam Roach <adam@nostrum.com> wrote:
>>>
>>> On 3/5/19 3:52 AM, Alexey Melnikov wrote:
>>>> My apologies for filing a procedural DISCUSS on this, but I am looking at:
>>>>
>>>> 7.5.  Determining the IdP URI
>>>>
>>>>    3.  The path, starting with "/.well-known/idp-proxy/" and appended
>>>>        with the IdP protocol.  Note that the separator characters '/'
>>>>        (%2F) and '\' (%5C) MUST NOT be permitted in the protocol field,
>>>>        lest an attacker be able to direct requests outside of the
>>>>        controlled "/.well-known/" prefix.  Query and fragment values MAY
>>>>        be used by including '?' or '#' characters.
>>>>
>>>> "idp-proxy" is not registered in the IANA's
>>>> <https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml>
>>>> registry and this document doesn't register it either. If I missed where this
>>>> is registered, please point me to the right document. If I haven't, please
>>>> register it in this document.
>>>>
>>> Good catch! Thanks.
>>>
>>> /a
>> I submitted a PR:
>> https://github.com/rtcweb-wg/security-arch/pull/86/files
>> And fired off a message to the expert list.
> The response from the DE:
>
> From: Mark Nottingham <mnot@mnot.net>
> Date: Thu, 14 Mar 2019 14:53:35 +1100
> Cc: wellknown-uri-review@ietf.org,
>   draft-ietf-rtcweb-security-arch.all@ietf.org
> To: Sean Turner <sean@sn3rd.com>
>
> Looks fine to me, although it'd be better to refer to 5785bis.
>
>> On 7 Mar 2019, at 12:30 pm, Sean Turner <sean@sn3rd.com> wrote:
>>
>> Hi! We=E2=80=99re looking to register idp-proxy.  It=E2=80=99s used =
> in:
>> https://datatracker.ietf.org/doc/draft-ietf-rtcweb-security-arch/
>> We forgot to register it (Alexey caught it) and I submitted the
>> following PR to add it:
>> https://github.com/rtcweb-wg/security-arch/pull/86/files
>> Let us know what you think.
>>
>> spt
>> _______________________________________________
>> wellknown-uri-review mailing list
>> wellknown-uri-review@ietf.org
>> https://www.ietf.org/mailman/listinfo/wellknown-uri-review