[Txauth] alternative charter writeup

[Dick Hardt <[e-mail]>]

Hey

I've written an alternative charter that I hope captures some of the
feedback on Justin's charter.

I found it easier to rewrite the charter to broaden the marketplace of
ideas.

Key ideas:

- This work supports existing OAuth 2.0, and OpenID Connect use cases.

- The client interacts directly with the authorization server.

/Dick

----

This group is chartered to develop a delegated identity and authorization
protocol. The use cases supported by this protocol will include widely
deployed use cases currently supported by OAuth 2.0, and OpenID Connect. In
contrast to OAuth 2.0 and OpenID Connect, where the protocol is initiated
by redirecting the user's browser to an authorization server, this protocol
will be initiated by the client directly interacting with the authorization
server.

Additionally, the protocol will allow:
- fine-grained specification of resource access
- the user to approve requests for identity claims and access to multiple
resources in one interaction
- web, mobile, single-page, and other client applications
- taking advantage of optimization features in HTTP2 and HTTP3

The group will define extension points for this protocol to allow for
flexibility in areas including:

- discovery of the authorization server
- cryptographic agility for keys, message signatures, and proof of
possession
- user interaction mechanisms including web and non-web methods- token
presentation mechanisms and key bindings

Although the artifacts for this work are not intended or expected to be
backwards-compatible with OAuth 2.0 or OpenID Connect, they will attempt to
simplify porting from OAuth 2.0 and OpenID Connect, and strive to reuse
existing semantics such as client identifiers, OAuth 2.0 scopes and access
tokens, and OpenID Connect ID Tokens and claims.

While the initial work will focus on using HTTP for communication between
the client and the authorization server, the working group will strive to
enable simple mapping to other protocols such as COAP.


ᐧ