See the reply that I just sent to Ludwig. I believe that we could get a
straight RFC 7800 (“cnf” claim) port done as an RFC at the same time or soon
after CWT becomes an RFC. ACE needs PoP keys and other applications do too,
and we should try to provide them expeditiously. I invited Ludwig to be a
co-editor on the straight port with me to help make sure we move it forward
promptly.
draft-ietf-ace-oauth-authz could then profile the RFC 7800 port by saying how
it uses the general confirmation syntax (this profiling text already exists).
Would that work for people?
Best wishes,
-- Mike
-----Original Message-----
From: Ace [mailto:[email protected]] On Behalf Of Carsten Bormann
Sent: Friday, April 21, 2017 1:33 AM
To: Hannes Tschofenig <[email protected]>
Cc: [email protected]
Subject: Re: [Ace] CWT and PoP Tokens
On Apr 21, 2017, at 09:56, Hannes Tschofenig
<[email protected]<mailto:[email protected]>> wrote:
>
> * the CWT spec maps some of the JWT claims to CBOR but does not
> contain anything regarding PoP tokens.
> * the ACE framework provides the PoP-related components (see
> https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-06#section-5.5.4.5).
>
> Now, the question to the group is whether they are happy with this
> split. Another option would be to include the cnf claims needed for
> the PoP token functionality already in the CWT spec.
Probably, the “cnf” claims attain their actual meaning through the framework.
It will be hard to do a framework-independent definition of those in the CWT
spec.
So I am very happy with that split.
Grüße, Carsten
_______________________________________________
Ace mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ace
