Re: [GNAP] Gathering Consent and Authorization

[Fabien Imbault <[e-mail]>]

Hi,

Remember that for convenience, the PR generates an HTML draft, so you
should be able to read easily.
See
https://deploy-preview-242--gnap-core-protocol-editors-draft.netlify.app/

In particular section 4 is now called Determining Authorization and Consent.

Cheers
Fabien

On Fri, Apr 9, 2021 at 5:12 PM Denis <[e-mail]> wrote:

> Hi  Justin,
>
> "Gathering Consent"  is not solely related with a section that would be
> called “Interaction at the AS”.
>
> For authorizing a method on an object, the RS (or more precisely the RO
> controlling that object) is wishing to obtain some privileges
> (i.e. attributes types and /or rights ) inside an access token that may be
> issued by *one AS among several ASs*.
>
> The privileges a RS is wishing to obtain should be proportionate to the
> method that is being requested on the object. This means that
> in the first access to a RS, the client should advertise both the method
> and the object on which the method applies and then in its response,
> the RS should indicate which choices are possible and the reason(s) behind
> each choice ("User Notice").
>
> In general, it is possible to decompose the end-user choice into three
> consecutive choices:
>
> a) a first choice for selecting the AS,
> b) a second choice for selecting different privileges *types *(i.e.
> attributes types and /or rights types) for the selected AS,
> c) a third choice selecting different privileges *values *for the
> selected privileges types (i.e. attributes type values and /or rights types
> values)
>
> If a RS is only trusting one AS, the first choice becomes a YES or NO
> question. The second choice must be based on information provided by the RS,
> since only the RS is knowing the rational to request some set of
> privileges. In such a case , the dialogue with the end-user can be done
> either
> *directly at the RS* or *locally at the client* using information
> provided by the RS. The third choice must be done at the AS.
>
> If a RS is trusting more than one AS, the first and the second choices
> must be done before contacting an AS (see above), while the third choice
> must be done at the AS.
>
> Denis
>
> PS. I have not yet read through the new text.
>
>
> We’ve recently had a lot of good discussion about the nature and role of
> the AS within GNAP, and the editors stated that we would be working on new
> text to incorporate this discussion. With that in mind, I wanted to bring
> everyone’s attention to a PR that makes some big changes to the core spec,
> though mostly in the description of how components work and less with the
> normative syntax of the protocol itself.
>
> https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/242
>
> This rewrites the section that is currently “Interaction at the AS” to
> better describe the wider range of possibilities for the authorization
> process. Note that this PR hasn’t been tagged as “pending merge” by the
> editors yet, which means there’s not a review deadline in place yet, but
> since it’s such a big change we’d like to get it in somewhat soon. Please
> go read through the new text and help improve it!
>
> Thank you,
>  — Justin
>
>
> --
> TXAuth mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/txauth
>