Hi Mike, Thanks for your mail.
First, I would like to argue for a registry that has more than one level. We need a two level registry because the different extensions have (and will also in the future) have different extension policies. The structure of the registry is: urn:ietf:params:oauth:<class>:<id> On the first level, the <class> part, we have high level functionality that was defined in the core specification. This includes things like 1) authorization grants (which you call grant-type in your registration request in http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-12) So, this would be urn:ietf:params:oauth:grant-type 2) client authentication mechanism (which you call client-assertion-type in http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-12 but should rather mean something like client-auth-type) So, this could be something like urn:ietf:params:oauth:client-auth-type 3) Access Token Types (which is called 'token-type' in http://www.ietf.org/id/draft-ietf-oauth-json-web-token-00.txt) This is urn:ietf:params:oauth:token-type. [PS: The text in the http://tools.ietf.org/html/draft-ietf-oauth-v2-28#section-8.1 for registering new access token types is a bit confusing and I am not sure whether an absolute URI would actually be required even though it makes a lot of sense.] While I believe that our initial requirement for "RFC required" for adding these top level classes makes sense since these basic extension features to OAuth are really core to the protocol functionality it is good that the group checks them carefully. Then, at the <id> level the individual values reside. For the authorization grant this is 'saml2-bearer' as defined in http://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-12#section-6. So, what is the right policy for adding values under urn:ietf:params:oauth:grant-type? http://tools.ietf.org/html/draft-ietf-oauth-v2-28#section-8.3 says what the policy is. So, instead of re-deciding a new policy for adding entries here it would be good to get it inline with what the policy is in the core spec. What could go wrong if the two are not aligned? I actually had that case in the DIME working group. Without going into the details the registry had a much stronger policy (RFC required) than the protocol specification (which only required a specification, if I remember it). The consequence was that people couldn't easily register new values from other organizations since they would fail in the last step when a new registry value had to be created (since IANA then told them 'RFC Required'). Consequently, these other organizations who wanted to get their work done then avoided doing so by misusing other extensions, which was really not good. Mike, you have actually been suggesting that a three level category for certain classes of sub-registries is actually OK as well. That may be true and we could relax the text to say that whoever defines the class also decides about the structure of the child elements underneath it. What I believe we need to add in the document is to populate the registry with the three URIs (from above; referring to the classes) and pointing to the policy from the core specification. Then, other docs (like draft-ietf-oauth-json-web-token-00.txt) can just put their values in there. Ciao Hannes On Jun 21, 2012, at 9:14 PM, Mike Jones wrote: > This draft is much clearer. Thanks for the quick turn-around. > > One question: You added: > *Index value: values subordinate to urn:ietf:params:oauth are of the from > urn:ietf:params:oauth:<class>:<id> with <class>:<id> as the index value > Why bake the assumption of a two-level structure into the registry? > > For instance, you could easily imagine legal and useful registrations of the > form <class>:<subclass>:<id>, etc. > > Maybe change this to say: > *Index value: values subordinate to urn:ietf:params:oauth are of the from > urn:ietf:params:oauth:<value> with <value> as the index value. It is > suggested that <value> include both a "class" and an > "identifier-within-class" component, with the two components being separated > by a colon (":"); other compositions of the <value> may also be used. > > -- Mike > > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of > [email protected] > Sent: Thursday, June 21, 2012 10:53 AM > To: [email protected] > Cc: [email protected] > Subject: [OAUTH-WG] I-D Action: draft-ietf-oauth-urn-sub-ns-03.txt > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Web Authorization Protocol Working Group of > the IETF. > > Title : An IETF URN Sub-Namespace for OAuth > Author(s) : Brian Campbell > Hannes Tschofenig > Filename : draft-ietf-oauth-urn-sub-ns-03.txt > Pages : 7 > Date : 2012-06-21 > > Abstract: > This document establishes an IETF URN Sub-namespace for use with > OAuth related specifications. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-oauth-urn-sub-ns > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-oauth-urn-sub-ns-03 > > A diff from previous version is available at: > http://tools.ietf.org/rfcdiff?url2=draft-ietf-oauth-urn-sub-ns-03 > > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth > > > _______________________________________________ > OAuth mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/oauth _______________________________________________ OAuth mailing list [email protected] https://www.ietf.org/mailman/listinfo/oauth
