Re: [Txauth] Call for WG name preferences

[Dick Hardt <[e-mail]>]

Thanks for posting Justin, speaking for myself, I appreciate the background
as I had not seen the term "intent" be used.

Can you share any history why "lodging intent" was the term selected vs
other choices? Why not "request"? Overused?

To me, an intent is an action ie. the client saying "I am going to do X",
whereas a request is asking for something, the client saying "I would like
X"

Or is the idea the client saying "I intend to request X"?

FWIW: I don't see the term "intent" used in PAR. It is a "request".

On Fri, Jun 5, 2020 at 7:59 AM Justin Richer <[e-mail]> wrote:

> Since there seems to be some confusion by a few people about the term
> “Intent” and its inclusion here, I wanted to clarify that for people. There
> is a protocol feature is variously known as “intent registration” or
> “lodging intent”, where the party starting the process (the client) makes a
> statement about what it wants to do and is then given the tools to complete
> the next steps to do that. It’s a key feature of the pattern we’re looking
> to codify in this group’s work.
>
> The FAPI working group in the OIDF has done a lot of work around it, and
> you see this style in a bunch of different financial APIs dating back
> decades:
>
>
> https://bitbucket.org/openid/fapi/src/master/Financial_API_Lodging_Intent.md
>
> https://bitbucket.org/openid/fapi/issues/142/standardising-lodging-intent
>
>
> Torsten Lodderstedt has a great blog post that touches on it as well:
>
>
> https://medium.com/oauth-2/transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-2326e2038948
>
> And it’s the basis behind OAuth 2.0’s Pushed Authorization Request (PAR)
> extension that’s happening now:
>
> https://tools.ietf.org/html/draft-ietf-oauth-par
>
>
> https://medium.com/oauth-2/pushed-authorization-requests-draft-adopted-by-oauth-working-group-a1060007150f
>
>
> To be clear, I’m not saying this is sufficient for it driving the name,
> but I do think it’s important that people be familiar with this terminology
> as its likely to come up again as the work progresses.
>
>  — Justin
>
> On Jun 4, 2020, at 7:25 PM, Mike Jones <
> Michael.Jones=[e-mail]> wrote:
>
> *Prefer:*
>     * GNAP    Grant Negotiation and Authorization Protocol – The focus on
> grants is correct.  And it’s a snappy name.
>     * GranPro    GRAnt Negotiation Protocol – The focus on grants is
> correct.  Pronounceable.
>     * NIRAD    Negotiation of Intent Registration and Authority Delegation
> – Cool sci-fi sounding name.
>     * PAuthZ    Protocol for Authorization – Accurate description.
>     * RefAuthZ    Refactored Authorization Protocol – Accurate description.
>     * ReAuthZ    Reimagined Authorization Protocol – Accurate description.
>     * WRAC (Web Resource Authorization Collaboration) - Pronounced like
> RACK – Cool name, with history going back to OAuth WRAP.
>     * XAuthZ    eXtensible authoriZation protocol – Accurate description.
>
> *Wouldn't object to:*
>     * AAuthZ    Alternative Authorization Protocol (AAuthZ)
>     * AZARP    AuthoriZed Access to Resources Protocol
>     * AZARAP    AuthoriZation And Resource Access Protocol
>     * BeBAuthZ    Back-end Based Authorization Protocol
>     * DAZARAP    Delegated AuthoriZation And Resource Access Protocol
>     * TINOA   This Is Not OAuth
>
> *Object to:*
>     * BYOAuthZ    Build-Your-Own Authorization Protocol – Too cheesy.
>     * CPAAP    Comprehensive Privileged Authentication Authorization
> Protocol – Too much like a medical device name.
>     * DIYAuthZ    Do-It-Yourself Authorization Protocol – Too cute.
>     * IDPAuthZ    Intent Driven Protocol for Authorization – IDP already
> means something else.
>     * TIAAP    Tokenized Identity and Access Protocol – I don’t know what
> “tokenized” is referring to here.
>     * TIDEAuth    Trust via Intent Driven Extension Auth – I don’t know
> what “intent” is referring to here.
>     * TIDYAuth    Trust via Intent Driven Yield Auth – I don’t know what
> “intent” is referring to here.
>     * TIEAuth    Trust via Intent Extension Auth – I don’t know what
> “intent” is referring to here.
>     * TXAuth    Testable eXtensible Authorization – I don’t know what
> “testable” is referring to here.
>     * TxAuth      Transmission of Authority – It’s delegation of authority
> – not transfer of authority.
>     * TXAuth      Truly eXtensible Authorization – Too cute.
>
>                                                        -- Mike
>
> --
> Txauth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/txauth
>
>
> --
> Txauth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/txauth
>
ᐧ