[Wimse] Re: Token Exchange and Translation Protocol

["Flemming Andreasen (fandreas)" <[e-mail]>]

Hi Dean

I think we are largely on the same page here. Wrt. the use cases I-D, I assume you are referring to https://www.ietf.org/archive/id/draft-gilman-wimse-use-cases-00.html ? If so, that draft expired in February, and I'm not clear on what the intent of it is going forward. Regardless, when you look at the use cases described in there, I don't see anything specifically talking about token exchange/translation. I think I generally understand the notion of token exchange based on RFC 8693, however I'm less clear on token translation as defined in the draft. The AWS-to-SPIFFE scenario described in the draft makes sense, and I am asking for more such examples to help guide the specific translations we shold be focusing on (profiles). From a documentation point of view, I like the more descriptive style of some of the use cases, but I also recognize the value of the user story approach taken in the use-cases draft above - a combination of the two would be ideal from my point of view.

Cheers

-- Flemming


On 7/31/24 14:47, Dean Saxe wrote:
Flemming,

Thank you again for the feedback.


For IETF 120 the most important output (IMHO) was to frame up the problem space and an approach to solving for the use cases we identified.  The doc is rough and at a high level because we really needed feedback to inform the next steps - are we approaching this problem from the right perspective?  Are we missing something in the existing RFCs?

I agree that there’s more work to be done on the use cases draft to inform this document.

Additional commentary/questions inline below.

-dhs
--
Dean H. Saxe, CIDPRO<https://idpro.org/cidpro/>
Principal Engineer, Office of the CTO
Beyond Identity
[e-mail]<mailto:[e-mail]>




On Jul 30, 2024 at 6:16:23 PM, Flemming Andreasen (fandreas) <fandreas=[e-mail]<mailto:[e-mail]>> wrote:
We have a charter item corresponding to this document and I don't see any other candidate documents at this time, so I vote for A.

The document is pretty rough though and mostly introduces some of the problems to consider. Additionally, the document would benefit from the following:
- More work on the requirements to feed into this document (per separate e-mail thread on requirements)
- A set of representative use case scenarios to illustrate what we are after. This is especially important for the "token translation" scenarios.

How is this different from the use cases described in the use cases I-D?  Are these more concrete examples or something entirely different?

- Clarity on whether we aim to use (/profile) RFC 8693 for "token translation" or whether that is only for "token exchange"

I have an action item to follow up with Brian Campbell on this as discussed in the WG last week.


- Clarity on which token formats we want to be able to translate/exchange. While the document notes that these will be provided as "translation profiles", we shold understand the target ones early on, and develop at least some of them in parallel with the basic translation/exchange protocol.

I am supportive of developing the profiles side-by-side with this ID.  I thought I had said that in the meeting, but if I did not, that was my intent.  My thought process was to enable profiles to be developed on a separate track to allow the WG to deliver RFC candidates more quickly without allowing one profile to bog down the work on the larger token translation doc.

If you have suggested token translations to focus on in the near term, please let me know.



Cheers

-- Flemming


On 7/29/24 08:25, Justin Richer wrote:
Following discussion in Vancouver, the chairs would like to begin discussion on what the next steps should be for the Token Exchange and Translation Protocol document [1], an output of the Token Exchange Design Team. This is not a call for adoption as there was a clear indication in the room that the document was not yet ready for this stage.

Please reply to the list to indicate that:

A: You believe this document should be developed into a state that the WG can adopt it. (Please discuss what you believe would be required changes for this. Please keep in mind that a call for adoption is a starting point for a document, not a finished document.)

B: You believe this document should NOT be developed further by the WG. (Please indicate why if possible)

C: You need more information before making this decision. (Please indicate what information you’d need)

D: You don’t give a flying rat about this document (i.e., this is not a topic you care strongly about)


Please reply to the list by August 12th, 2024.

— Justin and Pieter

[1] https://datatracker.ietf.org/doc/draft-saxe-wimse-token-exchange-and-translation/





--
Wimse mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>