[Secdispatch] Re: Topics for IETF 120

[Jim Fenton <[e-mail]>]

Hi David,

Glad to hear about your progress. We’re still waiting for guidance 
from IESG on whether alldispatch will continue at IETF 121, or whether 
we will revert to the individual dispatch groups like secdispatch. Of 
course it would be good to get a reading from Deb and Paul, but unless 
the decision is obvious it would probably be best to take it to 
secdispatch or alldispatch next.

-Jim

On 11 Sep 2024, at 11:49, David Brossard wrote:

> Hi Jim,
>
> With IETF 120 in the back, I wanted to circle back and talk about next
> steps. After the lightning talk, a few folks came up to me to talk 
> about
> their needs for an authorization policy language. In OAuth, there is 
> also a
> need but the consensus was that the language should live outside OAuth 
> and
> OAuth would just be a consumer of it. Other WGs e.g. WIMSE, SCIM, ACE 
> of
> course, and perhaps SPICE,
>
> I am thinking therefore that ALFA 2.0 would belong to the Security 
> Area
> (SEC). Is the next step to talk to Deb & Paul?
>
> The current stub of a draft is here:
> https://datatracker.ietf.org/doc/draft-brossard-alfa-authz/ . I have 
> also
> CCed my two co-authors, Andy Clymer from Rock Solid Knowledge (UK) and 
> Theo
> Dimitrakos (IFIPTM, UK and Huawei, Germany) who should be able to 
> attend
> IETF 121 in Dublin.
>
> Thanks for your insights,
> David.
>
> On Fri, Jul 12, 2024 at 11:02 AM David Brossard 
> <[e-mail]>
> wrote:
>
>> Hi Jim, all,
>>
>> Thanks for taking the time to reply. Apologies for missing the 
>> deadline.
>> This is my first IETF and I wasn't paying close attention.
>>
>> I will take you up on the lightning talk option. Per the rules on 
>> this
>> site <https://datatracker.ietf.org/group/hotrfc/about/> , I will 
>> email a
>> short abstract to [e-mail].
>>
>> I'm looking forward to meeting you in person,
>> David.
>>
>>
>> On Mon, Jul 8, 2024 at 11:06 AM Jim Fenton <[e-mail]> 
>> wrote:
>>
>>> David,
>>>
>>> Thanks for reaching out. Copying alldispatch chairs (which includes
>>> Rifaat).
>>>
>>> For this IETF, we are again experimenting with a unified 
>>> “dispatch”
>>> session called alldispatch. That seems relevant here because this 
>>> topic
>>> seems like it might be in Aecurity Area or in ART (applications/real 
>>> time)
>>> Area, and the idea of alldispatch is to have a unified venue, 
>>> especially
>>> when it isn’t entirely clear which area something belongs in.
>>>
>>> At this point, the agenda for alldispatch at IETF 120 is full. We 
>>> had a
>>> deadline for agenda topics a couple of weeks ago as well.
>>>
>>> If you want to do something at IETF 120, you have a couple of 
>>> options: 1)
>>> Give a lightning talk to pitch the idea at the Hot RFC Lightning 
>>> Talks on
>>> Sunday evening, and/or 2) Set up an informal side meeting and 
>>> recruit
>>> relevant people to come to it.
>>>
>>> Let us know if you have any other questions.
>>>
>>> -Jim
>>>
>>> On 8 Jul 2024, at 10:35, David Brossard wrote:
>>>
>>> Dear Dispatch owners,
>>>
>>> First of all, my apologies if I'm supposed to email 
>>> [e-mail]
>>> rather than owners. I'm new(ish) to IETF and its processes.
>>>
>>> My name's David and I've been involved in authorization and its
>>> standardization for the past 15 years. I've worked at OASIS and am
>>> currently the co-chair of the OpenID AuthZEN WG.
>>>
>>> As I'm more and more interested in the overlap between AuthZ and
>>> authentication, I'll be taking part in the OAuth WG sessions and 
>>> have
>>> submitted a draft ID
>>> <https://datatracker.ietf.org/doc/draft-brossard-oauth-rar-authzen/> 
>>> for
>>> their consideration. I've already reached out to Rifaat and some of 
>>> the
>>> OAuth folks (whom I know relatively well from my interactions at IIW 
>>> and
>>> other venues).
>>>
>>> Additionally, I'd like to propose a new standard for authorization 
>>> policy
>>> language - or to be more specific an evolution of an old and trusted
>>> standard: ALFA 2.0. It's a modernization of ALFA (released in 2012) 
>>> itself
>>> a modernization of XACML (initially started in 2001). Because it's 
>>> so
>>> relevant to OAuth, I thought IETF could be a natural home for the 
>>> draft
>>> standard. I'm not sure, though, OAuth itself would be the natural WG 
>>> for
>>> this work hence my reaching out to you.
>>>
>>> I've not submitted an ID just yet but will have a framework out by
>>> today's deadline.
>>>
>>> Let me know what good next steps should be and which WG you believe 
>>> would
>>> be a natural home for ALFA 2.0. IF you want to read up on ALFA 
>>> itself,
>>> here's a deck I put together for IIW
>>> <https://www.slideshare.net/slideshow/internet-identity-workshop-iiw-2023-introduction-to-alfa-authorization-language/267197190>
>>> last year. There's also https://alfa.guide which is a site I 
>>> maintain
>>> (in the spirit of Aaron P.'s oauth.net website).
>>>
>>> Thanks for your time,
>>> David.
>>>
>>>
>>
>> --
>> ---
>> David Brossard
>> http://www.linkedin.com/in/davidbrossard
>> http://twitter.com/davidjbrossard
>> http://about.me/brossard
>> ---
>> Stay safe on the Internet: IC3 Prevention Tips
>> <https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf>
>> Prenez vos précautions sur Internet:
>> http://www.securite-informatique.gouv.fr/gp_rubrique34.html
>>
>
>
> -- 
> ---
> David Brossard
> http://www.linkedin.com/in/davidbrossard
> http://twitter.com/davidjbrossard
> http://about.me/brossard
> ---
> Stay safe on the Internet: IC3 Prevention Tips
> <https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf>
> Prenez vos précautions sur Internet:
> https://cyber.gouv.fr/bonnes-pratiques-protegez-vous