Re: [Txauth] Barry Leiba's No Objection on charter-ietf-gnap-00-01: (with COMMENT)

[Roman Danyliw <[e-mail]>]

Hi Barry,

A few quick responses/edits before the telechat.

> -----Original Message-----
> From: iesg <[e-mail]> On Behalf Of Barry Leiba via Datatracker
> Sent: Wednesday, June 24, 2020 2:11 PM
> To: The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail]
> Subject: Barry Leiba's No Objection on charter-ietf-gnap-00-01: (with
> COMMENT)
> 
> Barry Leiba has entered the following ballot position for
> charter-ietf-gnap-00-01: No Objection
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/charter-ietf-gnap/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> > (in contrast
> > with OAuth 2.0 which is initiated by the client redirecting the user’s
> > browser)
> 
> Editorial nit: This needs a comma after “OAuth 2.0”.

Fixed.

> > The client and Authorization Server (AS) will involve a user to make
> > an authorization decision as necessary through interaction mechanisms
> > indicated by the protocol.
> 
> This sentence seems very clumsy and unclear.  The primary thing that bothers
> me is “mechanisms indicated by the protocol”: can we rephrase that to make it
> clearThe primary thing that bothers me is “mechanisms indicated by the
> protocol”: can we rephrase that to make it clearer what we’re talking about,
> perhaps by splitting the sentence, explaining what this means first, and then
> putting the rest of the sentence after it?  Maybe something like this:
> 
> NEW
> The protocol will include interaction mechanisms that <some brief
> explanation>.
>  The client and Authorization Server (AS) will use those mechanisms to involve
> a user, as necessary, to make authorization decisions. END

Todo.

> > - Support for directed, audience-restricted access tokens
> 
> What does “audience-restricted” mean?  Maybe this would be better phrased
> as, “Support for directed access tokens that restrict <explanation>” ?

I'd prefer we not change this text too much.  "Audience restricted" is a term of art in this space.  See Section 4.8.1.3 of draft-ietf-oauth-security-topics, draft-ietf-oauth-resource-indicators and draft-ietf-oauth-rar.

> > - Optimized inclusion of additional information through the delegation
> > process (including identifiers and identity assertions)
> 
> Editorial nit: the parenthetical is misplaced:
> 
> NEW
> - Optimized inclusion of additional information (including identifiers and
> identity assertions) through the delegation process END

Fixed.

> > The group is chartered to develop mechanisms for conveying identity
> information > within the protocol including identifiers […] and assertions > […]
> > The group is > not chartered to develop new formats for identifiers or
> assertions
> 
> It would be good to add “existing” after “including”, for emphasis.

Fixed.

Regards,
Roman