[Wimse] Re: IDs from Token Exchange Design Team

[Pieter Kasselman <[e-mail]>]

Thank you Dean

The chairs would like to thank the design team for the time taken and effort made to prepare these drafts.

We would like to encourage all working group members to review it, open GitHub issues and bring specific points for discussion to the mailing list.

We look forward to discussing these drafts in Vancouver.

Pieter and Justin

From: Saxe, Dean <deansaxe=[e-mail]>
Sent: Monday, July 8, 2024 8:13 PM
To: [e-mail]
Cc: Andrii Deinega <[e-mail]>; Dmitry Izumskiy <[e-mail]>; George Fletcher <[e-mail]>; Yaroslav Rosomakho <[e-mail]>
Subject: [Wimse] IDs from Token Exchange Design Team

As of today, there are two IDs published from the Token Exchange Design team for discussion at IETF120:

https://datatracker.ietf.org/doc/draft-rosomakho-wimse-tokentranslation-reqs/ describes the requirements and security considerations for a workload-focused token translation protocol.

https://datatracker.ietf.org/doc/draft-saxe-wimse-token-exchange-and-translation/ describes the token translation protocol and its relationship with token exchange.  In this draft we lay out a framework for discussing token exchange (as defined by RFC 8693) versus token translations which may “lose” data in translation.  Further, we identify that specific translations between different token types must be profiled elsewhere.  This choice was made to ensure that the draft does not have to define specific implementations where there may be a loss of context between different token types.  In the long run, I hope that this will allow the draft to progress faster while profiles are drafted for specific token pairs in parallel.  We have not yet specified the protocol for token translation to meet the requirements as defined in draft-rosomakho-wimse-tokentranslation-reqs-00.

I expect that these choices will lead to discussion both on the mailing list as well as at IETF120.

Two administrivia notes:

  1.  This is my last week with Amazon. I’m migrating my work with IETF to my personal email address, [e-mail]<mailto:[e-mail]>.
  2.  As part of this change, the GitHub repo for draft-saxe-wimse-token-exchange-and-translation has moved to a new location: https://github.com/deansaxe/wimse-token-exchange-and-translation.

Thank you to Andrii Deinega, ˚Dmitry Izumskiy, George Fletcher, and Yaroslav Rosomakho for their collaboration developing these IDs.  I look forward to discussing both IDs at IETF120 and hearing the WG’s input to help guide us.

Respectfully,
-dhs
--
Dean H. Saxe, CIDPRO<https://idpro.org/cidpro/> (he/him)
Senior Security Engineer, AWS Identity Security Team | Amazon Web Services (AWS)
E: [e-mail]<mailto:[e-mail]> | M: 206-659-7293<tel:[phone]>