[GNAP] RS Draft Updates

[Justin Richer <[e-mail]>]

Hi WG,

We’ve been working through the issues filed against the RS draft ahead of the Prague meeting. As you’ve probably seen on the summary, there are a number of PRs to update text. Most of these address existing issues:

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/65 - adds token format references

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/66 - updates IANA considerations sections based on other feedback

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/70 - during token derivation, require that the token being presented is applicable to the RS presenting it (built-in introspection, essentially)

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/71 - list token formats supported during resource set registration

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/72 - be more clear about token introspection responsibilities and expectations for the AS

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/73 - update the RS-facing discovery document to match the format of core



Additionally, there are a couple new features and clarifications that didn’t have issues filed but we fixed along the way:

https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/69 - add the “token management token” to the token model under the classes of special tokens, like the continuation access token


https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/74 - this small change allows an AS to use a key-bound GNAP access token to protect calls to the RS-facing API. This API already requires authentication by the RS, so this is just an additional option where it makes sense for an AS to use it. This feature is reminiscent of an UMA feature from the distributed authorization specification, which utilized a construct known as the protection API access token (PAT).


https://github.com/ietf-wg-gnap/gnap-resource-servers/pull/75 - adds the “end user” as an entity to the token model, particularly in cases where the end user and RO are different and it’s important for the system to know about that difference. This does not map directly to an existing JWT field at this time.




We’re still working on the expanded security considerations as discussed in the wake of discussions at OSW and during the reviews, as well as some editorial rewrites for the intro and abstract. Once this is done and the above PRs are incorporated, we believe the document will be ready for WGLC. Please review the above text changes, as the editors would like to publish a new document ahead of Prague — the cutoff date for new drafts is this coming Monday.

 — Justin