Re: [GNAP] Gathering Consent and Authorization

[Denis <[e-mail]>]

Hi  Justin,

"Gathering Consent"  is not solely related with a section that would be 
called “Interaction at the AS”.

For authorizing a method on an object, the RS (or more precisely the RO 
controlling that object) is wishing to obtain some privileges
(i.e. attributes types and /or rights ) inside an access token that may 
be issued by *one AS among several ASs*.

The privileges a RS is wishing to obtain should be proportionate to the 
method that is being requested on the object. This means that
in the first access to a RS, the client should advertise both the method 
and the object on which the method applies and then in its response,
the RS should indicate which choices are possible and the reason(s) 
behind each choice ("User Notice").

In general, it is possible to decompose the end-user choice into three 
consecutive choices:

    a) a first choice for selecting the AS,
    b) a second choice for selecting different privileges *types *(i.e.
    attributes types and /or rights types) for the selected AS,
    c) a third choice selecting different privileges *values *for the
    selected privileges types (i.e. attributes type values and /or
    rights types values)

If a RS is only trusting one AS, the first choice becomes a YES or NO 
question. The second choice must be based on information provided by the RS,
since only the RS is knowing the rational to request some set of 
privileges. In such a case , the dialogue with the end-user can be done 
either
*directly at the RS* or *locally at the client* using information 
provided by the RS. The third choice must be done at the AS.

If a RS is trusting more than one AS, the first and the second choices 
must be done before contacting an AS (see above), while the third choice
must be done at the AS.

Denis

PS. I have not yet read through the new text.


> We’ve recently had a lot of good discussion about the nature and role 
> of the AS within GNAP, and the editors stated that we would be working 
> on new text to incorporate this discussion. With that in mind, I 
> wanted to bring everyone’s attention to a PR that makes some big 
> changes to the core spec, though mostly in the description of how 
> components work and less with the normative syntax of the protocol 
> itself.
>
> https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242 
> <https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242>
>
> This rewrites the section that is currently “Interaction at the AS” to 
> better describe the wider range of possibilities for the authorization 
> process. Note that this PR hasn’t been tagged as “pending merge” by 
> the editors yet, which means there’s not a review deadline in place 
> yet, but since it’s such a big change we’d like to get it in somewhat 
> soon. Please go read through the new text and help improve it!
>
> Thank you,
>  — Justin
>