[Secdispatch] Re: Topics for IETF 120

[David Brossard <[e-mail]>]

Hi Jim,

With IETF 120 in the back, I wanted to circle back and talk about next
steps. After the lightning talk, a few folks came up to me to talk about
their needs for an authorization policy language. In OAuth, there is also a
need but the consensus was that the language should live outside OAuth and
OAuth would just be a consumer of it. Other WGs e.g. WIMSE, SCIM, ACE of
course, and perhaps SPICE,

I am thinking therefore that ALFA 2.0 would belong to the Security Area
(SEC). Is the next step to talk to Deb & Paul?

The current stub of a draft is here:
https://datatracker.ietf.org/doc/draft-brossard-alfa-authz/ . I have also
CCed my two co-authors, Andy Clymer from Rock Solid Knowledge (UK) and Theo
Dimitrakos (IFIPTM, UK and Huawei, Germany) who should be able to attend
IETF 121 in Dublin.

Thanks for your insights,
David.

On Fri, Jul 12, 2024 at 11:02 AM David Brossard <[e-mail]>
wrote:

> Hi Jim, all,
>
> Thanks for taking the time to reply. Apologies for missing the deadline.
> This is my first IETF and I wasn't paying close attention.
>
> I will take you up on the lightning talk option. Per the rules on this
> site <https://datatracker.ietf.org/group/hotrfc/about/>, I will email a
> short abstract to [e-mail].
>
> I'm looking forward to meeting you in person,
> David.
>
>
> On Mon, Jul 8, 2024 at 11:06 AM Jim Fenton <[e-mail]> wrote:
>
>> David,
>>
>> Thanks for reaching out. Copying alldispatch chairs (which includes
>> Rifaat).
>>
>> For this IETF, we are again experimenting with a unified “dispatch”
>> session called alldispatch. That seems relevant here because this topic
>> seems like it might be in Aecurity Area or in ART (applications/real time)
>> Area, and the idea of alldispatch is to have a unified venue, especially
>> when it isn’t entirely clear which area something belongs in.
>>
>> At this point, the agenda for alldispatch at IETF 120 is full. We had a
>> deadline for agenda topics a couple of weeks ago as well.
>>
>> If you want to do something at IETF 120, you have a couple of options: 1)
>> Give a lightning talk to pitch the idea at the Hot RFC Lightning Talks on
>> Sunday evening, and/or 2) Set up an informal side meeting and recruit
>> relevant people to come to it.
>>
>> Let us know if you have any other questions.
>>
>> -Jim
>>
>> On 8 Jul 2024, at 10:35, David Brossard wrote:
>>
>> Dear Dispatch owners,
>>
>> First of all, my apologies if I'm supposed to email [e-mail]
>> rather than owners. I'm new(ish) to IETF and its processes.
>>
>> My name's David and I've been involved in authorization and its
>> standardization for the past 15 years. I've worked at OASIS and am
>> currently the co-chair of the OpenID AuthZEN WG.
>>
>> As I'm more and more interested in the overlap between AuthZ and
>> authentication, I'll be taking part in the OAuth WG sessions and have
>> submitted a draft ID
>> <https://datatracker.ietf.org/doc/draft-brossard-oauth-rar-authzen/> for
>> their consideration. I've already reached out to Rifaat and some of the
>> OAuth folks (whom I know relatively well from my interactions at IIW and
>> other venues).
>>
>> Additionally, I'd like to propose a new standard for authorization policy
>> language - or to be more specific an evolution of an old and trusted
>> standard: ALFA 2.0. It's a modernization of ALFA (released in 2012) itself
>> a modernization of XACML (initially started in 2001). Because it's so
>> relevant to OAuth, I thought IETF could be a natural home for the draft
>> standard. I'm not sure, though, OAuth itself would be the natural WG for
>> this work hence my reaching out to you.
>>
>> I've not submitted an ID just yet but will have a framework out by
>> today's deadline.
>>
>> Let me know what good next steps should be and which WG you believe would
>> be a natural home for ALFA 2.0. IF you want to read up on ALFA itself,
>> here's a deck I put together for IIW
>> <https://www.slideshare.net/slideshow/internet-identity-workshop-iiw-2023-introduction-to-alfa-authorization-language/267197190>
>> last year. There's also https://alfa.guide which is a site I maintain
>> (in the spirit of Aaron P.'s oauth.net website).
>>
>> Thanks for your time,
>> David.
>>
>>
>
> --
> ---
> David Brossard
> http://www.linkedin.com/in/davidbrossard
> http://twitter.com/davidjbrossard
> http://about.me/brossard
> ---
> Stay safe on the Internet: IC3 Prevention Tips
> <https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf>
> Prenez vos précautions sur Internet:
> http://www.securite-informatique.gouv.fr/gp_rubrique34.html
>


-- 
---
David Brossard
http://www.linkedin.com/in/davidbrossard
http://twitter.com/davidjbrossard
http://about.me/brossard
---
Stay safe on the Internet: IC3 Prevention Tips
<https://www.capefearnetworks.com/wp-content/uploads/2017/05/Internet-Fraud-Prevention-Tips-IC3.pdf>
Prenez vos précautions sur Internet:
https://cyber.gouv.fr/bonnes-pratiques-protegez-vous