[Wimse] Fwd: New Version Notification for draft-sheffer-wimse-s2s-protocol-00.txt
Yaron Sheffer <yaronf.ietf@gmail.com> Wed, 03 July 2024 18:19 UTC
Return-Path: <yaronf.ietf@gmail.com>
X-Original-To: wimse@ietfa.amsl.com
Delivered-To: wimse@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A7B0C169407 for <wimse@ietfa.amsl.com>; Wed, 3 Jul 2024 11:19:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wi8OqvpWMFj9 for <wimse@ietfa.amsl.com>; Wed, 3 Jul 2024 11:19:31 -0700 (PDT)
Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com [IPv6:2607:f8b0:4864:20::b35]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2B43C16941F for <wimse@ietf.org>; Wed, 3 Jul 2024 11:19:30 -0700 (PDT)
Received: by mail-yb1-xb35.google.com with SMTP id 3f1490d57ef6-e0354459844so5655783276.3 for <wimse@ietf.org>; Wed, 03 Jul 2024 11:19:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1720030770; x=1720635570; darn=ietf.org; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=JMokjk3CFe6mkr2EeP0XQ/LFaDWr443TryuWIBgeY9g=; b=l1S2uc1Qcv8jqsJ03YVhPqct65kV0pj6ksGDQC7uc71HwpAKRB1rOsNyUS2MYIEkC1 pejSGlP6syYkKzsfNhq/BAu0UN6QwVyMxQpPbnMfe/8MzDBo/jOoiwq66EYm2nokDImM ttrn7bSctU/FfdP7ui4RAk98jjvO6glS1wjjJFHihoQNlR6ULqW8owIxXk1cv554J6ou h1G7Dg+eqSskzFqrlYXZNOCq+TjAZyMyA8UxROVsPq6FBdh1V3vA4Ba4H5Px6YBI2dnP bg2BIRoxNNa7/f2zM7P4YPWXBXXZktX6yOFzXpKr4QCiSexhxyJwYGhQRKE2kajzY3UO 2qOg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720030770; x=1720635570; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=JMokjk3CFe6mkr2EeP0XQ/LFaDWr443TryuWIBgeY9g=; b=G5CLmxkoz6mW2cF2CH5GnnYIvPJ8kmc/atUESiwm91v7WFs+PMhtZKa+ZQ+JK+X9AL hPGP7EHwrDQzQl/ispsu5zj3l5AgQCP37+AqzxTHdcDtC7BVNIaA3QbOIncbY2ToHot+ t9oWsCTVpQrlKIcresIs4OXhEatOas9fw20XBig/F+z2MevkKYbQlYh3LmQypl8xVXrF mp0K5mqxWNeSbDStOs4APoZlWs4awjOo4sfjmcuiTX50iiwpKyzzedUheotz4EuTFjBm Hkyxb8aLJUT8ld6+2yxgfFovREnCZBKQXpkjYuTbp30EHWY+VP/VPS9Cb27EwEVtcW0x lwCg==
X-Gm-Message-State: AOJu0YwIceI5FO5R83eKU2qqIQCclVemWCT1BmTaIqG1ehX7Pw2UG9Ty 7ks1Y8Rgpf4NV7csdFwPApQr3bwioaojVy3IG726k7VREAyDu1jMGoXBe95ChoH5uLi7nMpRF/4 6kxBfF2LTompPbIAC9Z1q1cSXNOQj8ogE
X-Google-Smtp-Source: AGHT+IFWaSqibBNjO1pfyMjBr4pJcfXSBDN8LjIf3LfhAfdg5JTnrpBAPHKw9LArTgw8didFgmr6WZ4dAcdnfMZthPI=
X-Received: by 2002:a81:8313:0:b0:650:a1cb:b12d with SMTP id 00721157ae682-650a1cbc444mr49928867b3.20.1720030769509; Wed, 03 Jul 2024 11:19:29 -0700 (PDT)
MIME-Version: 1.0
References: <172002996152.1005451.5563247643902230109@dt-datatracker-5f88556585-g8gwj>
In-Reply-To: <172002996152.1005451.5563247643902230109@dt-datatracker-5f88556585-g8gwj>
From: Yaron Sheffer <yaronf.ietf@gmail.com>
Date: Wed, 03 Jul 2024 21:19:18 +0300
Message-ID: <CADULMU2mKShwBh2EuCuqY6aNs5hx8On0Qv6OXkcY9r-h+p1H1Q@mail.gmail.com>
To: wimse@ietf.org
Content-Type: text/plain; charset="UTF-8"
Message-ID-Hash: KYWXEC5FVBF6MJ5GWG3HHLTOHZMLXF6Y
X-Message-ID-Hash: KYWXEC5FVBF6MJ5GWG3HHLTOHZMLXF6Y
X-MailFrom: yaronf.ietf@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [Wimse] Fwd: New Version Notification for draft-sheffer-wimse-s2s-protocol-00.txt
List-Id: WIMSE Workload Identity in Multi-Service Environment <wimse.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/wimse/CsCsupjPZf-VrvaMzsYd8BZ-5M8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/wimse>
List-Help: <mailto:wimse-request@ietf.org?subject=help>
List-Owner: <mailto:wimse-owner@ietf.org>
List-Post: <mailto:wimse@ietf.org>
List-Subscribe: <mailto:wimse-join@ietf.org>
List-Unsubscribe: <mailto:wimse-leave@ietf.org>
Hi, This draft is the product of the service-to-service design team, and defines the protocol between two workloads communicating over HTTP (a.k.a. REST). This is still an individual draft. We plan to present it to the WG in Vancouver and ask the group to adopt it. Comments of course are most welcome. Until the draft is adopted, it is managed here: https://github.com/yaronf/wimse-s2s Feel free to open PRs/issues. Thanks, Yaron and the design team <div lang="en-IL" style="overflow-wrap: break-word;"><div class="m_-83710323851029722WordSection1"><p class="MsoNormal"><span style="font-size: 11pt;"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size: 11pt;"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-bottom: 12pt;"><a name="m_-83710323851029722__MailOriginal"><span>On 03/07/2024, 21:06, "internet-drafts@ietf.org" <internet-drafts@ietf.org> wrote:<u></u><u></u></span></a></p><div><p class="MsoNormal"><span><span>A new version of Internet-Draft draft-sheffer-wimse-s2s-<wbr>protocol-00.txt has<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>been successfully submitted by Yaron Sheffer and posted to the<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>IETF repository.<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Name: draft-sheffer-wimse-s2s-<wbr>protocol<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Revision: 00<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Title: WIMSE Service to Service Authentication<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Date: 2024-07-03<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Group: Individual Submission<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Pages: 21<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>URL: </span></span><a href="https://www.ietf.org/archive/id/draft-sheffer-wimse-s2s-protocol-00.txt" target="_blank"><span><span>https://www.ietf.<wbr>org/archive/id/draft-sheffer-<wbr>wimse-s2s-protocol-00.txt</span></span><span></span></a><span><span><u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Status: </span></span><a href="https://datatracker.ietf.org/doc/draft-sheffer-wimse-s2s-protocol/" target="_blank"><span><span>https://datatracker.ietf.org/<wbr>doc/draft-sheffer-wimse-s2s-<wbr>protocol/</span></span><span></span></a><span><span><u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>HTML: </span></span><a href="https://www.ietf.org/archive/id/draft-sheffer-wimse-s2s-protocol-00.html" target="_blank"><span><span>https://www.ietf.org/archive/<wbr>id/draft-sheffer-wimse-s2s-<wbr>protocol-00.html</span></span><span></span></a><span><span><u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span>HTMLized: </span></span><a href="https://datatracker.ietf.org/doc/html/draft-sheffer-wimse-s2s-protocol" target="_blank"><span><span>https://datatracker.ietf.org/<wbr>doc/html/draft-sheffer-wimse-<wbr>s2s-protocol</span></span><span></span></a><span><span><u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span>Abstract:<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span> The WIMSE architecture defines authentication and authorization for<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> software workloads in a variety of runtime environments, from the<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> most basic ones up to complex multi-service, multi-cloud, multi-<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> tenant deployments. This document defines the simplest, atomic unit<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> of this architecture: the protocol between two workloads that need to<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> verify each other's identity in order to communicate securely. The<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> scope of this protocol is a single HTTP request-and-response pair.<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> To address the needs of different setups, we propose two protocols,<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> one at the application level and one that makes use of trusted TLS<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> transport. These two protocols are compatible, in the sense that a<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> single call chain can have some calls use one protocol and some use<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> the other. Service A can call Service B with mutual TLS<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> authentication, while the next call from Service B to Service C would<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span> be authenticated at the application level.<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span>The IETF Secretariat<u></u><u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><div><p class="MsoNormal"><span><span><u></u> <u></u></span></span></p></div><span></span><div><p class="MsoNormal"><span><u></u> <u></u></span></p></div></div></div>
- [Wimse] Re: New Version Notification for draft-sh… Yaron Sheffer
- [Wimse] Fwd: New Version Notification for draft-s… Yaron Sheffer
- [Wimse] Re: New Version Notification for draft-sh… Pieter Kasselman