Re: [Txauth] Polymorphism (Was: JSON Schema?)

[Dick Hardt <[e-mail]>]

I agree with:

"I think polymorphism should be one of the tools in consideration from the
start."

I was disagreeing with the 'should' in:

"GNAP should make use of a polymorphic protocol structure"


On Mon, Jul 6, 2020 at 2:15 PM Justin Richer <[e-mail]> wrote:

> I once felt that way, too, and the first few iterations of XYZ did not use
> polymorphism. But I found, through hands-on experience, that it solves many
> more problems than it creates. I think that JWT didn’t quite do it because
> there was one limited place in the spec that used the feature — it was the
> exception, not a core part of the data model. And, JWT implementations that
> don’t expect an array in “aud” aren’t compliant, after all.
>
> This is obviously an implementation detail for the WG to debate, and I
> think polymorphism should be one of the tools in consideration from the
> start.
>
>  — Justin
>
> On Jul 6, 2020, at 4:41 PM, Dick Hardt <[e-mail]> wrote:
>
>
> Responding to Justin's polymorphism comments ...
>
> On Mon, Jul 6, 2020 at 12:54 PM Justin Richer <[e-mail]> wrote:
>
>> Polymorphism in the protocol is an important part of the XYZ proposal’s
>> design, and as a feature it directly addresses a number of the items you
>> found when doing your XAuth implementation, like parsing OAuth scopes and
>> dealing with the authorization/authorizations mutually-exclusive oddness
>> that you mentioned. I strongly believe that GNAP should make use of a
>> polymorphic protocol structure for these and other reasons. Polymorphism is
>> a built-in feature of the JSON data model, and it’s also fully possible to
>> support under CBOR and other data serialization languages. Even JWT most
>> famously uses polymorphism for the “aud” field, which can be a string or an
>> array of strings depending on context, all with clear semantics.
>>
>
>  I strongly disagree with "GNAP should make use of a polymorphic protocol
> structure"
>
> We should use it only if we really need it, and it makes implementations
> simpler. I personally don't think it accomplished that in JWT with the
> audience. I would bet there is a fair amount of code that does not check if
> the 'aud' property is an array, it just assumes it is a string.
>
> wrt. my authorization / authorizations oddness, polymorphism would not
> solve it as the contents of both authorization / authorizations in XAuth
> are objects.
>
> /Dick
>
>
>