Re: [Txauth] Reviewing draft-hardt-xauth-protocol-11 - Dictionary

Tom Jones <> Tue, 21 July 2020 02:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 94C563A12F2 for <>; Mon, 20 Jul 2020 19:30:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id M81a5EPYMKEL for <>; Mon, 20 Jul 2020 19:30:48 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id B4E933A12F1 for <>; Mon, 20 Jul 2020 19:30:48 -0700 (PDT)
Received: by with SMTP id h17so16044034oie.3 for <>; Mon, 20 Jul 2020 19:30:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=McdVSZDwHLSZo3LITj810yKCOSQ1f+gk6+xskp5E4lc=; b=oeVAC1WqqHlKvvpca2Va/9RyOaY0paUmANRJ3PeJkG5YA4gkTFvKDHl2uGhzWBvLEi Lofar6BEAYIW8LqkmhnuK6sVJtF+2wmHz96OrxzT/gUVdnYYThepsZ+G6nl9dDcUxDD1 7UeB+Y+zMxQMByyfCJ2+Q3UOB2bP/PePEVRBEejfLvHan724OjTXu7yWPliiNIuhMcj2 GObXE/hwxsM2Z/iLi6hvTX5OlqGmXxwfEjYeN9tFDAKbBrzTz6DWO+blFrNmsv5m2q5D HxR3oZbDeQCVHK7NKhcca0n6cUbYn0Ca27TRyAEqlDbEyOCxq23P/FNj/FmCW8tro1Rx wURA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=McdVSZDwHLSZo3LITj810yKCOSQ1f+gk6+xskp5E4lc=; b=dflSEpVe96SE5ySgYCxxANHGtJvluj/sDSBLncbLJtxSk9z9/a0VBdOlDVQpO33aYt 6w1+ru5QL0FMsq71lU9n9OvT3Cp5itwOMF/ZESZ83cox+alxxVXvOwZ9fs0KPesxM+WH udxNprYDTOMqyAp/vJPAw2Zu77CFftO2J3R5BjnG2RIHU/Z4bI1zoq9xGBSHXmiYw1e3 ESKfPs/BjxePaZtYWiWUNeFZ51zwexBj/gusRS7stVw2SZH+o13NrLUIlm1J4DbI5oM/ 4OfuBfdHLqaOOMhN4j1wixf4JRLL3cSAEHXUERXpuic8Whs+oUnXtnA4iieq3lJnnAyz 1dNA==
X-Gm-Message-State: AOAM532g5jKHQXhxr8LR3CzyUMRu69KBUS24ynb5uGuUB9fUPtmSf01O dg3Hnr5OkBiXDffBnB2ocWbXBIpAYUVff2qtlk4=
X-Google-Smtp-Source: ABdhPJxKQtz7ScQUWTkn0DxgGQmMSWbmbBucBvAmEEuMTZLpGLtNETdX0ZZhtpjXsor4OBNK/XIhX0J7x/lJ5pNhNmo=
X-Received: by 2002:aca:aa57:: with SMTP id t84mr1620797oie.131.1595298647963; Mon, 20 Jul 2020 19:30:47 -0700 (PDT)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Tom Jones <>
Date: Mon, 20 Jul 2020 19:30:35 -0700
Message-ID: <>
To: Francis Pouatcha <>
Cc:, Dick Hardt <>
Content-Type: multipart/alternative; boundary="00000000000039003405aaea69b0"
Archived-At: <>
Subject: Re: [Txauth] Reviewing draft-hardt-xauth-protocol-11 - Dictionary
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 21 Jul 2020 02:30:51 -0000

that sounds like a good start - some points.
1. Many of the statements, like the RO owns the data, are technically or
legally incorrect, but i think we know what you mean. - controls access
might be more appropo.
2. the user may be a delegate of the RO and have some sort of token that
proves his authority. It would be interesting to know if that token is in
scope.  If not perhaps I can find someone else to own it.
Peace ..tom

On Mon, Jul 20, 2020 at 6:01 PM Francis Pouatcha <fpo=> wrote:

> Hello Dick,
> Here is (in a new thread) the promised attempt to define terms of interest
> in the GNAP protocol.
> Party - represents a role in the GNAP protocol flow. A party can take the
> form of a web service, an application installed on the user device and
> acting autonomously or the form of a natural person (resp. of an autonomous
> device) using an application to interact with other parties.
> Resource - a piece of data or web service
>       - controlled by a Resource Owner (RO),
>       - held and guarded by a Resource Server (RS) and
>       - serviced by the RS to a Client, if the Client provides a valid
> Authorization.
> Resource Owner (RO) - the party that
>       - owns a Resource,
>       - relies on the services the GS to manage access to that Resource
> and
>       - relies on the services of a RS to hold the Resource and guard
> access to that Resource.
> Resource Server (RS) - the party that
>       - holds a resource and guards access to that resource on behalf of
> the RO,
>       - services the Resource to the requesting Client, provided the
> Client presents a valid Authorization.
>       The RS is generally deployed as a web service.
> Grant Server (GS) - the party that manages access to a Resource on behalf
> of the RO. For each Resource access request, the GS might request the
> consent of the RO and produce a corresponding Authorization that is given
> to the requesting Client.
> Consent - act of an RO approving the release of a Resource he owns to a
> Client.
> Grant - material form of an RO Consent. In order not to interact with the
> RO on each Resource access request, the GS might store the RO Consent in
> the form of a Grant for reuse.
> Authorization - externalized form of a Grant as known to the GS and the RS.
>       - The GS converts a Grant into an Authorization for use in a
> Resource access request.
>       - The RS evaluates an Authorization to decide on whether or not to
> release the Resource to the Client.
> Client - the party that provides the infrastructure used by a User to
> access a Resource. The client infrastructure is designed to:
>       - Receive the resource access request from the User,
>       - Interact with the RS to discover authorization requirements,
>       - Interact with the GS to obtain an Authorization to access the
> Resource,
>       - Interact with the RS to access the Resource on behalf of the User.
> User - the party using the infrastructure of the Client to gain access to
> a Resource.
> This dictionary is supposed to be the base for further discussions that
> will allow us to provide each term with just enough description to reduce
> ambiguities and misunderstandings in further exchanges. I intentionally
> omitted the specification of the type and nature of each party (For example
> Client / Registered Client / Dynamic Client). Such elaborations belong IMO
> in proper subsections.
> Comments are welcome.
> Best regards.
> --
> Francis Pouatcha
> Co-Founder and Technical Lead
> adorsys GmbH & Co. KG
> --
> Txauth mailing list