[Wimse] Re: Token Exchange and Translation Protocol

[Dean Saxe <[e-mail]>]

Thanks for the feedback, Joe.  I think these are fair requests.

-dhs
--
Dean H. Saxe, CIDPRO <https://idpro.org/cidpro/>
Principal Engineer, Office of the CTO
Beyond Identity
[e-mail]




On Aug 8, 2024 at 3:11:15 PM, Joseph Salowey <[e-mail]> wrote:

> I support A - continue to work on this document to develop it for working
> group adoption.  While the document needs a fair amount of work, I don't
> see anything that really hinders it from becoming something that we could
> adopt.
> What I would like to see in this document:
> 1. I would like to see the more concrete use cases and examples fleshed
> out more.  Maybe not all of them need to go into the document, but I think
> we will need these going forward.
> 2. Do we think that all the use cases will need to use a new token
> translation endpoint?  I'm not sure, but I really would like to understand
> the functionality and characteristics of the new endpoint.  Also it seems
> token exchange would work for some of the use cases, would the use of
> existing token exchange procedures be described in this document as well?
> 3. I like that there already are some security considerations in the
> document, but I'd like to see a bit more fleshed out before adoption, but
> it does not need to be exhaustive at this point.
>
> Thanks,
>
> Joe
>
>
> On Wed, Jul 31, 2024 at 2:04 PM Flemming Andreasen (fandreas) <fandreas=
> [e-mail]> wrote:
>
>> Hi Dean
>>
>> I think we are largely on the same page here. Wrt. the use cases I-D, I
>> assume you are referring to
>> https://www.ietf.org/archive/id/draft-gilman-wimse-use-cases-00.html ?
>> If so, that draft expired in February, and I'm not clear on what the intent
>> of it is going forward. Regardless, when you look at the use cases
>> described in there, I don't see anything specifically talking about token
>> exchange/translation. I think I generally understand the notion of token
>> exchange based on RFC 8693, however I'm less clear on token translation as
>> defined in the draft. The AWS-to-SPIFFE scenario described in the draft
>> makes sense, and I am asking for more such examples to help guide the
>> specific translations we shold be focusing on (profiles). From a
>> documentation point of view, I like the more descriptive style of some of
>> the use cases, but I also recognize the value of the user story approach
>> taken in the use-cases draft above - a combination of the two would be
>> ideal from my point of view.
>>
>> Cheers
>>
>> -- Flemming
>>
>>
>> On 7/31/24 14:47, Dean Saxe wrote:
>>
>> Flemming,
>>
>> Thank you again for the feedback.
>>
>>
>> For IETF 120 the most important output (IMHO) was to frame up the problem
>> space and an approach to solving for the use cases we identified.  The doc
>> is rough and at a high level because we really needed feedback to inform
>> the next steps - are we approaching this problem from the right
>> perspective?  Are we missing something in the existing RFCs?
>>
>> I agree that there’s more work to be done on the use cases draft to
>> inform this document.
>>
>> Additional commentary/questions inline below.
>>
>> -dhs
>> --
>> Dean H. Saxe, CIDPRO <https://idpro.org/cidpro/>
>> Principal Engineer, Office of the CTO
>> Beyond Identity
>> [e-mail]
>>
>>
>>
>>
>> On Jul 30, 2024 at 6:16:23 PM, Flemming Andreasen (fandreas) <fandreas=
>> [e-mail]> wrote:
>>
>>> We have a charter item corresponding to this document and I don't see
>>> any other candidate documents at this time, so I vote for A.
>>>
>>> The document is pretty rough though and mostly introduces some of the
>>> problems to consider. Additionally, the document would benefit from the
>>> following:
>>> - More work on the requirements to feed into this document (per separate
>>> e-mail thread on requirements)
>>> - A set of representative use case scenarios to illustrate what we are
>>> after. This is especially important for the "token translation" scenarios.
>>>
>>
>> How is this different from the use cases described in the use cases I-D?
>> Are these more concrete examples or something entirely different?
>>
>> - Clarity on whether we aim to use (/profile) RFC 8693 for "token
>>> translation" or whether that is only for "token exchange"
>>>
>>
>> I have an action item to follow up with Brian Campbell on this as
>> discussed in the WG last week.
>>
>>
>> - Clarity on which token formats we want to be able to
>>> translate/exchange. While the document notes that these will be provided as
>>> "translation profiles", we shold understand the target ones early on, and
>>> develop at least some of them in parallel with the basic
>>> translation/exchange protocol.
>>>
>>
>> I am supportive of developing the profiles side-by-side with this ID.  I
>> thought I had said that in the meeting, but if I did not, that was my
>> intent.  My thought process was to enable profiles to be developed on a
>> separate track to allow the WG to deliver RFC candidates more quickly
>> without allowing one profile to bog down the work on the larger token
>> translation doc.
>>
>> If you have suggested token translations to focus on in the near term,
>> please let me know.
>>
>>
>>
>>> Cheers
>>>
>>> -- Flemming
>>>
>>>
>>> On 7/29/24 08:25, Justin Richer wrote:
>>>
>>> Following discussion in Vancouver, the chairs would like to begin
>>> discussion on what the next steps should be for the Token Exchange and
>>> Translation Protocol document [1], an output of the Token Exchange Design
>>> Team. This is not a call for adoption as there was a clear indication in
>>> the room that the document was not yet ready for this stage.
>>>
>>> Please reply to the list to indicate that:
>>>
>>> A: You believe this document should be developed into a state that the
>>> WG can adopt it. (Please discuss what you believe would be required changes
>>> for this. Please keep in mind that a call for adoption is a starting point
>>> for a document, not a finished document.)
>>>
>>> B: You believe this document should NOT be developed further by the WG.
>>> (Please indicate why if possible)
>>>
>>> C: You need more information before making this decision. (Please
>>> indicate what information you’d need)
>>>
>>> D: You don’t give a flying rat about this document (i.e., this is not a
>>> topic you care strongly about)
>>>
>>>
>>> Please reply to the list by August 12th, 2024.
>>>
>>> — Justin and Pieter
>>>
>>> [1]
>>> https://datatracker.ietf.org/doc/draft-saxe-wimse-token-exchange-and-translation/
>>>
>>>
>>>
>>>
>>> --
>>> Wimse mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>>>
>>
>> --
>> Wimse mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
>