Re: [rtcweb] WebRTC REF for OAUTH based TURN

[Sean Turner <[e-mail]>]

> On Mar 14, 2018, at 09:33, Sean Turner <[e-mail]> wrote:
> 
> 
> 
>> On Mar 14, 2018, at 07:37, Harald Alvestrand <[e-mail]> wrote:
>> 
>> Den 13. mars 2018 15:14, skrev Cullen Jennings:
>>> 
>>> From a dependency point of view, I would like to note that right now the WebRTC PC spec references
>>> 
>>> * draft-ietf-oauth-pop-key-distribution
>>> 
>>> Which rumor has it has been replaced by 
>>> 
>>> * datatracker.ietf.org/doc/draft-ietf-ace-oauth-authz
>>> 
>>> Which normatively references the following:
>>> 
>>> * draft-ietf-ace-cbor-web-token
>>> * ietf-ace-cwt-proof-of-possession
>>> * draft-ietf-ace-cbor-web-token
>>> * draft-ietf-ace-cwt-proof-of-possession
>>> 
>>> More discussion of this at https://github.com/w3c/webrtc-pc/issues/1642
>>> 
>>> What needs to happen with all this so we can finish up the stuff WebRTC needs to reference from IETF ?
>>> 
>>> 
>>> 
>>> 
>>> 
>> 
>>> From a WG product management point of view, I consider that this has not
>> deployed, and is not likely to deploy in the present timeframe, given
>> that no consensus specifiation has emerged.
>> 
>> My suggestion would be to replace this text:
>> 
>> An OAuth 2.0 based authentication method, as described in [RFC7635]. It
>> uses the OAuth 2.0 Implicit Grant type, with PoP (Proof-of-Possession)
>> Token type, as described in [RFC6749] and [OAUTH-POP-KEY-DISTRIBUTION].
>> .... rest of section ....
>> 
>> with
>> 
>> An OAuth 2.0 based authentication method, as described in [RFC7635].
>> 
>> The amount of detail currently in the webrtc-pc document is, to my mind,
>> inappropriate for a W3C spec. If the IETF has failed to come up with a
>> single "handle" by which all this detail  can be referenced, the IETF
>> needs to solve that problem.
> 
> This seems to be like the right approach.
> 

For more info:
draft-ietf-ace-oauth-authz
Says:

  COSE is used to secure self-contained tokens such
   as proof-of-possession (PoP) tokens, which is an extension to the
   OAuth tokens.  The default token format is defined in CBOR web token
   (CWT) [I-D.ietf-ace-cbor-web-token].

ace-cbor-web-token is in Approved-announcement to be sent::Revised I-D Needed for 6 days
with no DOWNREF..

spt