Re: [Txauth] Call for WG name preferences - done!

[Yaron Sheffer <[e-mail]>]

Folks, we are past the deadline for name selections. Thank you all who shared their thoughts on time. Dick and I will go through all the responses and (most hopefully) will be able to announce the group’s consensus and submit it to the AD and IESG.

 

Thanks,

                Yaron

 

From: Justin Richer <[e-mail]>
Date: Friday, June 5, 2020 at 17:59
To: Mike Jones <Michael.Jones=[e-mail]>
Cc: Yaron Sheffer <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [Txauth] Call for WG name preferences

 

Since there seems to be some confusion by a few people about the term “Intent” and its inclusion here, I wanted to clarify that for people. There is a protocol feature is variously known as “intent registration” or “lodging intent”, where the party starting the process (the client) makes a statement about what it wants to do and is then given the tools to complete the next steps to do that. It’s a key feature of the pattern we’re looking to codify in this group’s work.

 

The FAPI working group in the OIDF has done a lot of work around it, and you see this style in a bunch of different financial APIs dating back decades:

 

https://bitbucket.org/openid/fapi/src/master/Financial_API_Lodging_Intent.md

 

https://bitbucket.org/openid/fapi/issues/142/standardising-lodging-intent

 

 

Torsten Lodderstedt has a great blog post that touches on it as well:

 

https://medium.com/oauth-2/transaction-authorization-or-why-we-need-to-re-think-oauth-scopes-2326e2038948

 

And it’s the basis behind OAuth 2.0’s Pushed Authorization Request (PAR) extension that’s happening now:

 

https://tools.ietf.org/html/draft-ietf-oauth-par

 

https://medium.com/oauth-2/pushed-authorization-requests-draft-adopted-by-oauth-working-group-a1060007150f

 

 

To be clear, I’m not saying this is sufficient for it driving the name, but I do think it’s important that people be familiar with this terminology as its likely to come up again as the work progresses. 

 

 — Justin



On Jun 4, 2020, at 7:25 PM, Mike Jones <Michael.Jones=[e-mail]> wrote:

 

Prefer:

    * GNAP    Grant Negotiation and Authorization Protocol – The focus on grants is correct.  And it’s a snappy name.

    * GranPro    GRAnt Negotiation Protocol – The focus on grants is correct.  Pronounceable.

    * NIRAD    Negotiation of Intent Registration and Authority Delegation – Cool sci-fi sounding name.

    * PAuthZ    Protocol for Authorization – Accurate description.

    * RefAuthZ    Refactored Authorization Protocol – Accurate description.

    * ReAuthZ    Reimagined Authorization Protocol – Accurate description.

    * WRAC (Web Resource Authorization Collaboration) - Pronounced like RACK – Cool name, with history going back to OAuth WRAP.

    * XAuthZ    eXtensible authoriZation protocol – Accurate description.

 

Wouldn't object to:

    * AAuthZ    Alternative Authorization Protocol (AAuthZ)

    * AZARP    AuthoriZed Access to Resources Protocol

    * AZARAP    AuthoriZation And Resource Access Protocol

    * BeBAuthZ    Back-end Based Authorization Protocol

    * DAZARAP    Delegated AuthoriZation And Resource Access Protocol

    * TINOA   This Is Not OAuth

 

Object to:

    * BYOAuthZ    Build-Your-Own Authorization Protocol – Too cheesy.

    * CPAAP    Comprehensive Privileged Authentication Authorization Protocol – Too much like a medical device name.

    * DIYAuthZ    Do-It-Yourself Authorization Protocol – Too cute.

    * IDPAuthZ    Intent Driven Protocol for Authorization – IDP already means something else.

    * TIAAP    Tokenized Identity and Access Protocol – I don’t know what “tokenized” is referring to here.

    * TIDEAuth    Trust via Intent Driven Extension Auth – I don’t know what “intent” is referring to here.

    * TIDYAuth    Trust via Intent Driven Yield Auth – I don’t know what “intent” is referring to here.

    * TIEAuth    Trust via Intent Extension Auth – I don’t know what “intent” is referring to here.

    * TXAuth    Testable eXtensible Authorization – I don’t know what “testable” is referring to here.

    * TxAuth      Transmission of Authority – It’s delegation of authority – not transfer of authority.

    * TXAuth      Truly eXtensible Authorization – Too cute.

 

                                                       -- Mike

 

-- 
Txauth mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/txauth