[OAUTH-WG] Timely review request: pre-draft-17

2011-07-04 Thread Eran Hammer-Lahav
I have started sharing my planned changes for ­17: https://github.com/hueniverse/draft-ietf-oauth Change log: https://github.com/hueniverse/draft-ietf-oauth/commit/24a48f99c204331264028 f66708427961a1bc102#diff-3 My main focus right now is to clarify client types, registration, and identificat

Re: [OAUTH-WG] New draft on UMA Core protocol --- FW: I-D Action: draft-hardjono-oauth-umacore-00.txt

2011-07-04 Thread Thomas Hardjono
Thanks Barry. Could you please add me to the OAUTH WG Agenda for a presentation on UMA. I will send you the slides before July 22nd. Thanks again. Regards. /thomas/ From: barryleiba.mailing.li...@gmail.com [barryleiba.mailing.li...@gmail.com] On Beha

Re: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 subsection on assertions

2011-07-04 Thread Brian Campbell
Either way. It could stay in there, if you want to show a concrete example of an extension grant type. Or it could be removed too - draft-ietf-oauth-assertions and draft-ietf-oauth-saml2-bearer will have plenty of examples. On Mon, Jul 4, 2011 at 12:54 PM, Eran Hammer-Lahav wrote: > What abo

Re: [OAUTH-WG] draft 16 review notes

2011-07-04 Thread Eran Hammer-Lahav
As I go over recent feedback, anything that requires additional text will be bounced back to the list for new proposed language. I need to receive it by noon PT Thur, to be included in –17 (assuming no objections). EHL From: Barry Leiba mailto:barryle...@computer.org>> Date: Mon, 4 Jul 2011 09:

Re: [OAUTH-WG] Draft 16 Security Considerations additions

2011-07-04 Thread Eran Hammer-Lahav
This needs to be reworked to reflect reality. The state value must be shared with the resource owner's browser and authorization server, so it is not really a secret known only to the client… EHL From: Mark Mcgloin mailto:mark.mcgl...@ie.ibm.com>> Date: Wed, 1 Jun 2011 11:28:33 -0700 To: Torste

Re: [OAUTH-WG] Section 10.1 (Client authentication)

2011-07-04 Thread Eran Hammer-Lahav
It's a pointless MUST given how undefined the requirements are. It will only be understood by security experts and they don't really need it. At a minimum, it needs some examples. EHL From: Torsten Lodderstedt mailto:tors...@lodderstedt.net>> Date: Wed, 1 Jun 2011 00:53:37 -0700 To: Eran Hamme

Re: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 subsection on assertions

2011-07-04 Thread Eran Hammer-Lahav
What about the example using SAML assertion? From: Brian Campbell mailto:bcampb...@pingidentity.com>> Date: Mon, 4 Jul 2011 11:42:21 -0700 To: Eran Hammer-lahav mailto:e...@hueniverse.com>> Cc: oauth mailto:oauth@ietf.org>> Subject: Re: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 su

Re: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 subsection on assertions

2011-07-04 Thread Brian Campbell
I believe the new assertion draft covers it and this change can be sidelined as long as the new draft has WG support to move forward. On Mon, Jul 4, 2011 at 12:38 PM, Eran Hammer-Lahav wrote: > In light of the new assertion draft, do we still want to make this change? > EHL > From: Brian Campbell

[OAUTH-WG] I-D Action: draft-ietf-oauth-assertions-00.txt

2011-07-04 Thread internet-drafts
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Web Authorization Protocol Working Group of the IETF. Title : OAuth 2.0 Assertion Profile Author(s) : Michael B. Jones Brian

Re: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 subsection on assertions

2011-07-04 Thread Eran Hammer-Lahav
In light of the new assertion draft, do we still want to make this change? EHL From: Brian Campbell mailto:bcampb...@pingidentity.com>> Date: Tue, 24 May 2011 07:25:12 -0700 To: oauth mailto:oauth@ietf.org>> Subject: [OAUTH-WG] TODO: Mike J./Chuck M. (or me) to draft 4.5.1 subsection on asserti

Re: [OAUTH-WG] Call For Agenda Items for IETF#81

2011-07-04 Thread Barry Leiba
> it is time to think about the agenda for the IETF#81 meeting in Quebec City. Adding to this, in case folks haven't looked at the draft IETF agenda: we're currently scheduled from 9 to 11:30 EDT (13:00 to 15:30 UTC) on Wednesday morning, 27 July -- BUT THAT MIGHT CHANGE. There will, as always, b

Re: [OAUTH-WG] Draft 16 comment

2011-07-04 Thread Eran Hammer-Lahav
Section 3: In addition, the authorization server MAY allow unauthenticated access token requests when the client identity does not matter (e.g. anonymous client) or when the client identity is established via other means. For readability purposes only, this specification is writte

[OAUTH-WG] Call For Agenda Items for IETF#81

2011-07-04 Thread Hannes Tschofenig
Hi all, it is time to think about the agenda for the IETF#81 meeting in Quebec City. Since we are planning to complete the current working group documents our focus will be on the working group items. Please sent me a mail off-list whether you are able to present your document. Here is a st

Re: [OAUTH-WG] draft 16 review notes

2011-07-04 Thread Barry Leiba
On Sun, Jul 3, 2011 at 11:21 PM, Eran Hammer-Lahav wrote: > Need proposed text. ... > Need proposed text. ... > Need proposed text. I will add to this that at this stage in the document development, any requests for changes need to be accompanied by specific proposed text. If you absolutely can'

Re: [OAUTH-WG] New draft on UMA Core protocol --- FW: I-D Action: draft-hardjono-oauth-umacore-00.txt

2011-07-04 Thread Barry Leiba
> FYI This is a new draft on the UMA Core protocol, which builds on OAuth2.0. > > Hopefully we can present/discuss it at IETF81 in Quebec City. The chairs will be happy to accept a presentation/discussion on this as time permits. That means it will go at the end of the agenda, and we will only ge

[OAUTH-WG] Reminder of draft submission deadlines

2011-07-04 Thread Barry Leiba
Important reminder to all draft editors: The deadline for submissions of -00 version drafts is TODAY, 4 July, at 17:00 PDT (23:59+ UTC). The deadline for submissions of later version drafts is NEXT MONDAY, 11 July, at 17:00 PDT (23:59+ UTC). Please don't miss the deadlines if you have drafts to