Re: [Txauth] TxAuth Charter (Take 3.5)

I completely agree that modularity of the documents is key, but keep in mind that the charter specifies only the total end result and not how the documents are split up. How we slice things is a key decision that the working group needs to make. I don’t think we’ll see everything in in a single document, but I do think we’ll see a lot more in a “core” document than is in OAuth 2 today. 

We aren’t setting out to just mash together OAuth 2 and all of its extensions, including OIDC — anything like that would clearly be suited for the OAuth WG. 

I think that if we’re careful and deliberate, especially if we’re not dragging legacy decisions “just because”, then we have a chance to make things really work here without getting overly complex. Much of OIDC’s complexity stems from it adding functionality to OAuth 2 or overcoming limitations in OAuth 2. A lot of that can go away if we are building these aspects together from the start. 

 — Justin

> On Jan 29, 2020, at 8:04 AM, Torsten Lodderstedt <torsten=40lodderstedt.net@dmarc.ietf.org> wrote:
> 
> 
> 
>> Am 29.01.2020 um 07:01 schrieb Dick Hardt <dick.hardt@gmail.com>:
>> 
>> 
>> 
>> 
>> On Tue, Jan 28, 2020 at 9:09 PM Torsten Lodderstedt <torsten@lodderstedt.net <mailto:torsten@lodderstedt..net>> wrote:
>> 
>> 
>> > Am 29.01.2020 um 02:13 schrieb Dick Hardt <dick.hardt@gmail.com <mailto:dick.hardt@gmail.com>>:
>> > 
>> > All identity claim use cases. A set of these are solved by OpenID Connect, which is an extension to OAuth 2.0. TxAuth would also be a superset of OpenID Connect in addition to OAuth.
>> 
>> Don’t you think this would make TxAuth a bit complicated? What would be the benefit?
>> 
>> Not any more than today, as many consumer IdPs have both in the same flows, and that is what is in the proposed charter. 
>> 
>> Having the information all in one document would make it simpler to implement and understand.
>> 
> 
> I doubt. If i calculate the size of all relevant oauth specs + all relevant openid connect specs (including verified claims), that will most likely be a multi 100 pages spec that few people will fully understand and be able to review/contribute to and fully & correctly implement.
> 
> Modularity and extensibility is key to success of this initiative.
> 
>> Did you have chance to look at XAuth Torsten?
> 
> Not in detail.
> 
>> 
>> -- 
>> Txauth mailing list
>> Txauth@ietf.org <mailto:Txauth@ietf.org>
>> https://www.ietf.org/mailman/listinfo/txauth <https://www.ietf.org/mailman/listinfo/txauth>
> -- 
> Txauth mailing list
> Txauth@ietf.org <mailto:Txauth@ietf.org>
> https://www.ietf.org/mailman/listinfo/txauth <https://www.ietf.org/mailman/listinfo/txauth>