- Wednesday, November 12, 2014

oauth@jabber.ietf.org

Wednesday, November 12, 2014< ^ >

derek has set the subject to: OAuth WG | http://tools.ietf.org/wg/oauth/ | IETF 90 audio stream: http://ietf90streaming.dnsalias.net/ietf/ietf903.m3u

Room Configuration

Room Occupants

GMT+0
[18:25:41] hillbrad@jabber.ccc.de joins the room
[18:51:24] Brian Campbell joins the room
[18:54:51] Brian Campbell leaves the room
[18:55:22] tlyu@mit.edu joins the room
[18:59:38] Brian Campbell joins the room
[19:00:31] Meetecho joins the room
[19:00:53] jtrentadams@gmail.com joins the room
[19:01:37] <jtrentadams@gmail.com> Morning, folks, I'll be your friendly "In-Room Voice" for this session.
[19:02:03] <jtrentadams@gmail.com> If you want something said in the room, please pre-pend your comments with "MIC:"
[19:02:09] <jtrentadams@gmail.com> Thanks!
[19:02:59] Brian Campbell _ joins the room
[19:03:16] Steve Olshansky joins the room
[19:03:20] <jtrentadams@gmail.com> On Mic: Mike Jones
[19:03:32] shoji joins the room
[19:05:22] <hillbrad@jabber.ccc.de> thanks, trent!
[19:05:46] <jtrentadams@gmail.com> Room difficulties… presentation screen of Justin's slides just went dead
[19:05:51] <jtrentadams@gmail.com> Coming back online now.
[19:06:06] <jtrentadams@gmail.com> On Mic: Justin
[19:06:30] <jtrentadams@gmail.com> http://tools.ietf.org/agenda/91/slides/slides-91-oauth-1.pdf
[19:06:58] Mary Barnes joins the room
[19:07:01] zhanna tsitkov joins the room
[19:07:11] zhanna tsitkov leaves the room
[19:09:30] mary.h.barnes joins the room
[19:09:35] <Brian Campbell _> MIC: a year + ago we talked about support in management for stateless  (from AS) client reg
[19:09:50] <Brian Campbell _> is that just not of interetest anymore?
[19:10:50] <jtrentadams@gmail.com> @Brian - spoken
[19:11:11] Kathleen Moriarty joins the room
[19:11:16] <Brian Campbell _> but client id can't change in reg mgmt
[19:11:25] <Brian Campbell _> and it is related
[19:11:44] <Brian Campbell _> that was for MIC
[19:11:45] <Brian Campbell _> sorry
[19:12:05] <jtrentadams@gmail.com> got it
[19:12:11] <jtrentadams@gmail.com> in queue
[19:12:32] mary.h.barnes leaves the room
[19:13:46] <jtrentadams@gmail.com> @Brian - spoken
[19:13:53] <Brian Campbell> thanks trent
[19:14:27] <jtrentadams@gmail.com> On Mic: Hannes
[19:15:03] <jtrentadams@gmail.com> On screen in room, and mailed the list - IPR Disclosure from Nokia on RFC 6749
[19:15:07] <Brian Campbell> sorry for making you speak my poor comments - this is my first remote participation and my realtime typing/spelling is poor at best
[19:15:26] <jtrentadams@gmail.com> @Brian - No worries, I enjoy being a vocal puppet.  ;)
[19:16:07] <jtrentadams@gmail.com> In Background / Not Mic: John Bradley mumbling
[19:17:05] <jtrentadams@gmail.com> On Mic: Kathleen Moriarty
[19:19:53] <jtrentadams@gmail.com> On Mic: Justin Richer
[19:20:01] <jtrentadams@gmail.com> Presentation: http://tools.ietf.org/agenda/91/slides/slides-91-oauth-3.pdf
[19:20:08] Karen O'Donoghue joins the room
[19:21:21] <jtrentadams@gmail.com> http://oauth.net/articles/authentication/
[19:24:48] Bill Mills joins the room
[19:26:48] <jtrentadams@gmail.com> On Mic: Phil Hunt
[19:27:03] metricamerica joins the room
[19:28:48] <jtrentadams@gmail.com> On Mic: Kathleen Moriarty
[19:29:29] metricamerica leaves the room
[19:29:32] <jtrentadams@gmail.com> On Mic: Justin Richer
[19:29:56] <jtrentadams@gmail.com> On Mic: Tony Nadalin
[19:32:24] drkurta joins the room
[19:32:42] <Bill Mills> auth is a huge space.
[19:33:09] <jtrentadams@gmail.com> On Mic: Leif Johanson
[19:33:38] <Bill Mills> I think to put auth in scope we need to scope it more.
[19:35:05] zwicky joins the room
[19:36:08] <jtrentadams@gmail.com> On Mic: Nat
[19:38:30] <jtrentadams@gmail.com> Jabber Folks - If you want to volunteer for anything called for in the room, let me know.
[19:38:34] <jtrentadams@gmail.com> On Mic: Mike Jones
[19:39:09] Ben Kaduk joins the room
[19:39:21] <Brian Campbell> MIC: I wrote a draft as comments
[19:39:38] <Brian Campbell> nevermide
[19:39:48] <Brian Campbell> it came up
[19:39:50] <jtrentadams@gmail.com> Got up… then sat down
[19:39:51] <jtrentadams@gmail.com> ;)
[19:40:15] <jtrentadams@gmail.com> On Mic: John Bradley (saying what Brian wanted to say)
[19:40:20] <Brian Campbell> :)
[19:40:27] <jtrentadams@gmail.com> On Mic: Justin
[19:40:34] Karen O'Donoghue leaves the room
[19:40:57] Karen O'Donoghue joins the room
[19:41:50] <jtrentadams@gmail.com> on Mic: Tony
[19:42:36] <Bill Mills> MIC: I'm not convinced that token exchange is the solution that we need in general.
[19:43:05] <jtrentadams@gmail.com> @bill - in queue
[19:43:49] Karen O'Donoghue leaves the room
[19:44:07] <Bill Mills> MIC: Acting on behalf of does need client auth, one of the subtleties that John mentioned, and this requires care.  Also, how much are we becoming SAML here?
[19:44:30] <jtrentadams@gmail.com> @bill - you want both?
[19:45:00] <Brian Campbell> MIC: a token exchange protocol should be generic enough to handle all types of tokens
[19:45:26] <jtrentadams@gmail.com> @brian - john is in queue and will voice you
[19:45:43] Sam S joins the room
[19:45:48] <Bill Mills> Ideally yes.  Don't want to do things that are Bearer only.
[19:46:02] <Brian Campbell> including access tokens, structured tokens, 'reference' tokens
[19:46:34] <Bill Mills> "Generic enough" was Brian
[19:46:40] <Bill Mills> but I agree
[19:46:41] <jtrentadams@gmail.com> @bill - voiced
[19:46:52] <Bill Mills> yes, thanks.  I have audio feed
[19:47:08] <jtrentadams@gmail.com> @bill - Eek - sorry about that, thanks.
[19:47:29] <Bill Mills> "acting on behalf of" should be done by an authenticated  client.
[19:48:54] <jtrentadams@gmail.com> On Mic: Justin
[19:48:56] <jtrentadams@gmail.com> http://tools.ietf.org/agenda/91/slides/slides-91-oauth-2.pdf
[19:52:15] <jtrentadams@gmail.com> On Mic: Tony
[19:53:15] <Bill Mills> MIC: because the client may not know how to interpret the token.
[19:53:47] <Bill Mills> nevermind, on the "MIC" part
[19:54:25] <jtrentadams@gmail.com> @bill - thanks for saving me… I couldn't figure out how to thread that comment in form the mic.
[19:54:34] <jtrentadams@gmail.com> s/form/from/
[19:55:17] Sam S leaves the room
[19:56:03] <Bill Mills> MIC: as long as introspection is generic enough that we can send a "token part" and it's not bound to the Bearer concept.
[19:56:08] Sam S joins the room
[19:56:35] <jtrentadams@gmail.com> @bill - in queue
[19:56:50] <Bill Mills> if it's only defined for Bearer and we have to extend it just to add a token type that will be wrong.
[19:57:26] <Bill Mills> which he just said
[19:57:32] <Bill Mills> yeah OK
[19:58:02] <jtrentadams@gmail.com> On Mic: Mic Jones
[19:58:16] <jtrentadams@gmail.com> s/Mic Jones/Mike Jones/
[19:58:41] <Bill Mills> that will mean that POP tokens need to have a new type and can't be "bearer", I'm cool with that
[19:59:03] Karen O'Donoghue joins the room
[19:59:35] <Brian Campbell> 6750
[20:02:46] <Bill Mills> I think it needs only the hooks for new token types
[20:02:56] <Bill Mills> WGLC otherwise
[20:03:33] <jtrentadams@gmail.com> Room Hum: muddy response, it's not ready for last call
[20:03:39] <jtrentadams@gmail.com> On Mic: Lucy Lynch
[20:04:14] <jtrentadams@gmail.com> On Mic: Tony
[20:05:12] Brian Campbell leaves the room
[20:05:12] <jtrentadams@gmail.com> On Mic: Nat
[20:05:30] Brian Campbell joins the room
[20:05:58] <jtrentadams@gmail.com> Presentation: ?? Can't find the slides for remote folks
[20:06:11] <jtrentadams@gmail.com> Writeup: http://datatracker.ietf.org/doc/draft-ietf-oauth-spop/
[20:06:28] <Brian Campbell _> http://www.slideshare.net/nat_sakimura/1112-spoppresso
[20:06:30] <Brian Campbell _> i think
[20:07:36] <Bill Mills> MIC: WGLC was aggressive/premature on this 'I think.
[20:08:10] <jtrentadams@gmail.com> @Bill - we've moved onto a new topic… but do you want me to regress?
[20:08:33] <Bill Mills> that was for SPOP
[20:08:43] <jtrentadams@gmail.com> Oh, sorry… will queue up
[20:09:14] Ben Kaduk leaves the room
[20:09:41] Dan Wing joins the room
[20:09:47] Catherine Dibble joins the room
[20:09:57] <Bill Mills> no, it was clear it was intentional... I just think it isn't ready
[20:10:27] tsitkova joins the room
[20:10:40] <Bill Mills> close but not ready
[20:13:21] Catherine Dibble leaves the room
[20:14:11] Dan Wing leaves the room
[20:14:37] Karen O'Donoghue leaves the room
[20:14:53] tony hansen joins the room
[20:15:42] <jtrentadams@gmail.com> On Mic: Leif
[20:16:12] tony hansen leaves the room
[20:18:25] Tony Hansen joins the room
[20:19:12] c.white78@gmail.com joins the room
[20:19:26] c.white78@gmail.com leaves the room
[20:19:47] <jtrentadams@gmail.com> On Mic: Justin
[20:20:11] <jtrentadams@gmail.com> On Mic: John Bradley
[20:20:22] <Bill Mills> MIC: do we need OAuth discovery separate from OpenID discovery?
[20:21:01] jtrentadams@gmail.com leaves the room
[20:21:48] <Bill Mills> I did try to do discovery 2+ years ago and was told in the end OpenID discovery was the thing to use
[20:21:49] jtrentadams@gmail.com joins the room
[20:22:53] <jtrentadams@gmail.com> @Bill - should I get into a boxing match with John for you?
[20:23:17] <Bill Mills> In fact, I objected to the name POP for POP tokens too, but was told POP already existed...
[20:23:43] <Bill Mills> He's actually more strident than I might have been, which is surprising.
[20:23:45] <Brian Campbell> MIC: "Request Correlation for the OAuth Authorization Code Grant"
[20:23:51] <Brian Campbell> as a title
[20:24:19] <Brian Campbell> a strawman
[20:24:21] <Brian Campbell> anyway
[20:24:28] <Bill Mills> Cross Client Request Forgery
[20:24:41] =JeffH joins the room
[20:25:29] <jtrentadams@gmail.com> Off Mic: John Bradley mumbling
[20:26:51] <jtrentadams@gmail.com> On Mic: Hannes outlining the Proof of Possession work
[20:27:06] <jtrentadams@gmail.com> http://datatracker.ietf.org/doc/draft-ietf-oauth-proof-of-possession/
http://datatracker.ietf.org/doc/draft-ietf-oauth-pop-key-distribution/
http://datatracker.ietf.org/doc/draft-ietf-oauth-pop-architecture/
http://datatracker.ietf.org/doc/draft-ietf-oauth-signed-http-request/
http://datatracker.ietf.org/doc/draft-ietf-oauth-proof-of-possession/
[20:27:42] c.white78@gmail.com joins the room
[20:28:36] <jtrentadams@gmail.com> On Mic: Tony
[20:29:32] ramkri123 joins the room
[20:30:08] <jtrentadams@gmail.com> FWIW - Tony is referencing work in the UTA WG presented earlier this week: http://tools.ietf.org/agenda/91/slides/slides-91-uta-2.pdf
[20:30:18] <jtrentadams@gmail.com> On Mic: John Bradley
[20:30:24] ramkri123 leaves the room
[20:30:36] c.white78@gmail.com leaves the room
[20:36:32] <jtrentadams@gmail.com> On Mic: Lief
[20:39:31] <jtrentadams@gmail.com> On Mic: Kathleen Moriarty
[20:39:44] <jtrentadams@gmail.com> On Mic: Phil Hunt
[20:40:59] Bodo Moeller joins the room
[20:41:07] <jtrentadams@gmail.com> On Mic: Justin
[20:41:50] <Bill Mills> App to app requires soemthing like Kerberos and key management and all that jazz.
[20:45:57] <jtrentadams@gmail.com> Chairs are having an off-mic conversation
[20:47:02] <Bill Mills> Is there a compelling reason to WGLC?
[20:47:10] <Bill Mills> on that architecture draft?
[20:47:11] <jtrentadams@gmail.com> Bill you want to object?
[20:47:18] <Bill Mills> Yeah, anti-hummm
[20:47:31] <Bill Mills> yes
[20:47:51] <Bill Mills> I can object on list I supposed
[20:47:53] <jtrentadams@gmail.com> @bill - I supplied your proxy hum in objection for WGLC
[20:48:04] <Bill Mills> tx
[20:48:12] <jtrentadams@gmail.com> The in-room hum was pretty clear that they want to move it forward.
[20:48:41] <jtrentadams@gmail.com> On Mic: John Bradley
[20:48:54] <Bill Mills> I just don't see a point of setting the architecture in stone when we haven't got any working implementations even close
[20:49:36] <jtrentadams@gmail.com> On Mic: Phil HUnt
[20:50:18] <jtrentadams@gmail.com> Room shows PoP would be implemented by a reasonable number of folks
[20:50:44] <jtrentadams@gmail.com> Open Mic time
[20:51:05] <jtrentadams@gmail.com> On Mic: John Bradley
[20:54:59] <jtrentadams@gmail.com> On Mic: Justin
[20:55:34] <Bill Mills> adjusting referrer would be in the browser, no?
[20:56:25] <jtrentadams@gmail.com> On Mic: Kathleen Moriarty
[20:57:51] <jtrentadams@gmail.com> On Mic: Mike Jones
[21:00:45] <jtrentadams@gmail.com> Off Mic: Much mumbling
[21:02:04] <Bill Mills> Bailing here.  Wish I was in Hawaii...
[21:02:15] Bill Mills leaves the room
[21:02:18] <jtrentadams@gmail.com> @bill - yeah, we've seen the inside of a wonderful hotel
[21:04:16] <jtrentadams@gmail.com> On Mic: Mike Jones
[21:04:35] =JeffH leaves the room
[21:06:49] <jtrentadams@gmail.com> That's all folks — the room has dissolved into pockets of conversation and administrative work.
[21:07:08] <jtrentadams@gmail.com> remote folks - You're on your own without a voice.  Cheers!
[21:07:14] jtrentadams@gmail.com leaves the room
[21:07:19] Kathleen Moriarty leaves the room
[21:07:28] Mary Barnes leaves the room
[21:07:35] Steve Olshansky leaves the room
[21:07:38] Brian Campbell leaves the room
[21:08:07] Brian Campbell _ leaves the room
[21:08:35] Kathleen Moriarty joins the room
[21:10:06] Bodo Moeller leaves the room
[21:10:10] tlyu@mit.edu leaves the room
[21:12:16] hillbrad@jabber.ccc.de leaves the room
[21:13:15] Meetecho leaves the room
[21:14:03] Steve Olshansky joins the room
[21:18:35] zwicky leaves the room
[21:18:35] tsitkova leaves the room
[21:22:05] Steve Olshansky leaves the room
[21:23:53] shoji leaves the room
[21:24:52] drkurta joins the room
[21:30:33] zwicky joins the room
[21:36:35] drkurta leaves the room
[21:38:38] Sam S leaves the room
[21:43:35] zwicky leaves the room
[21:45:16] Kathleen Moriarty leaves the room
[21:48:18] Bodo Moeller joins the room
[21:49:02] Bodo Moeller leaves the room: Disconnected: closed
[21:51:33] Bodo Moeller joins the room
[21:52:36] Bodo Moeller leaves the room: Disconnected: Replaced by new connection
[21:52:36] Bodo Moeller joins the room
[21:55:34] Bodo Moeller leaves the room
[22:00:47] Bodo Moeller joins the room
[22:04:02] Bodo Moeller leaves the room: Disconnected: closed
[22:05:59] =JeffH joins the room
[22:18:21] tsitkova joins the room
[22:26:04] tsitkova leaves the room
[22:28:40] drkurta leaves the room
[22:28:42] drkurta joins the room
[22:30:47] jtrentadams@gmail.com joins the room
[22:32:18] jtrentadams@gmail.com leaves the room
[22:44:36] drkurta leaves the room
[22:44:52] drkurta joins the room
[22:47:06] drkurta leaves the room
[22:47:15] drkurta joins the room
[22:50:15] =JeffH leaves the room
[22:55:06] drkurta leaves the room
[22:55:07] drkurta joins the room
[22:56:50] zwicky joins the room
[23:03:56] Kathleen Moriarty joins the room
[23:04:01] Kathleen Moriarty leaves the room
[23:09:49] zwicky joins the room
[23:10:06] zwicky leaves the room
[23:13:58] tsitkova joins the room
[23:32:17] Steve Olshansky joins the room
[23:34:54] tsitkova leaves the room
[23:39:06] Steve Olshansky leaves the room
[23:44:16] Steve Olshansky joins the room
[23:51:06] Steve Olshansky leaves the room
[23:52:12] Steve Olshansky joins the room