Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft 15?

From: Julian Reschke <[email-masked]>
Date: Sun, 01 Jan 2012 20:15:02 +0100

On 2011-12-31 20:40, Mike Jones wrote:
> Maybe I misunderstood your position.  If you agree that '\' may not occur in the INPUT string, then that issue can be closed.  That was the working group consensus position, per the cited e-mails.  I thought that you were arguing that syntax restrictions on the parameters should only be placed upon the OUTPUT string - which forces all implementations to support unnecessary encodings like "\a\b\c" for "abc".  Please let me know whether you're fine with the working group prohibiting the use of '\' in the input string as the spec presently currently does.

I'm not ok with that; because it's totally besides the point.

A recipient of WWW-Authenticate needs to use a proper parser for that 
header field. And if you use a proper parser, it doesn't matter.

I'm not saying anybody should send something like that. What I'm saying 
is that you shouldn't create an illusion that a recipient doesn't need 
to deal with it.

A recipient that can't handle quoted-string syntax in auth-params is 
broken. A recipient that can't handle token syntax in auth-params is 
broken as well.

Finally, please re-read what I said: the syntax of the challenge is 
defined by HTTP. The bearer spec can't change the parsing rules, because 
you need a generic parser to properly handle header fields containing 
multiple challenges. Once that generic parser has done it's job, it 
should not matter anymore whether a value used the token syntax or the 
quoted-string syntax, and also it shouldn't matter anymore where 
unescaping has taken place or not.

What you're trying to do is comparable with defining an XML vocabulary 
where you profile how an attribute is serialized (' vs  ", character 
encoding, escaping). Don't.

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Sun, 1 Jan 2012 19:41:42 +0000

I'll note that in some profiles, the Bearer challenge may be the only one that the application may legally use.  In that case, there's no need to be able parse other challenges that the application can't fulfill in the first place.  The application would fail if an unsupported challenge type was used in either case.

As editor, I'll note that it doesn't seem like this discussion is moving the process forward anymore.  I believe that we've sufficiently clarified that you hold a different position than the working group consensus (which I realize is your right to do).  I also believe that the issues have been sufficiently well discussed on the list for all parties to be well informed.

Therefore, it seems that my earlier observation still holds:  In the New Year, the chairs and area directors (and possibly the OAuth design committee) will need to decide how to proceed on this issue.  It would be good to see the spec finished shortly.

				All the best,
				-- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Sunday, January 01, 2012 11:15 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

A recipient of WWW-Authenticate needs to use a proper parser for that header field. And if you use a proper parser, it doesn't matter.

I'm not saying anybody should send something like that. What I'm saying is that you shouldn't create an illusion that a recipient doesn't need to deal with it.

A recipient that can't handle quoted-string syntax in auth-params is broken. A recipient that can't handle token syntax in auth-params is broken as well.

Finally, please re-read what I said: the syntax of the challenge is defined by HTTP. The bearer spec can't change the parsing rules, because you need a generic parser to properly handle header fields containing multiple challenges. Once that generic parser has done it's job, it should not matter anymore whether a value used the token syntax or the quoted-string syntax, and also it shouldn't matter anymore where unescaping has taken place or not.

What you're trying to do is comparable with defining an XML vocabulary where you profile how an attribute is serialized (' vs  ", character encoding, escaping). Don't.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Sun, 01 Jan 2012 20:49:18 +0100

> I'll note that in some profiles, the Bearer challenge may be the only one that the application may legally use.  In that case, there's no need to be able parse other challenges that the application…

The ability to send multiple challenges with the recipient taking the 
strongest one it supports is an important part of HTTP auth. I'd like to 
understand what scenario would disable that.

> As editor, I'll note that it doesn't seem like this discussion is moving the process forward anymore.  I believe that we've sufficiently clarified that you hold a different position than the workin…

For completeness, I'll repeat that I don't think that there was WG 
consensus for your point of view, but I'll leave it to the chairs to 
decide how to proceed.

> Therefore, it seems that my earlier observation still holds:  In the New Year, the chairs and area directors (and possibly the OAuth design committee) will need to decide how to proceed on this iss…

Yes, it would. I still have no idea what's keeping you from doing what 
HTTPbis recommends. It would be extremely helpful to get *technical* 
feedback on that (so far I haven't seen any).

Best regards, Julian

---

From: William Mills <[email-masked]>
Date: Tue, 3 Jan 2012 11:35:40 -0800 (PST)

Is all this only around the scope parameter?  My mail cited below is with regards to the character set for a valid scope parameter, which we should be able to define and then lean on the HTTPbis spec for the actual parameter syntax.

________________________________
 From: Mike Jones <[email-masked]>
To: Julian Reschke <[email-masked]> 
Cc: Mark Nottingham <[email-masked]>; Barry Leiba <[email-masked]>; OAuth WG <[email-masked]> 
Sent: Friday, December 30, 2011 3:19 PM
Subject: Re: [OAUTH-WG] auth-param syntax, was:  OK to post OAuth Bearer draft 15?
 
I did already back the statement that this is the working group consensus with the e-mails attached in this note sent to you on December 12, 2011:
  - http://www.ietf.org/mail-archive/web/oauth/current/msg08042.html

But since that apparently wasn't convincing to you that this working group decision represents more than "just me disagreeing with you", here are references to individual messages referenced in the above e-mail:
  - Eran Hammer-Lahav: http://www.ietf.org/mail-archive/web/oauth/current/msg07698.html
  - John Bradley:  http://www.ietf.org/mail-archive/web/oauth/current/msg07699.html
  - William Mills:  http://www.ietf.org/mail-archive/web/oauth/current/msg07700.html
  - Mike Jones:  http://www.ietf.org/mail-archive/web/oauth/current/msg07701.html
  - Phil Hunt:  http://www.ietf.org/mail-archive/web/oauth/current/msg07702.html
  - Justin Richer:  http://www.ietf.org/mail-archive/web/oauth/current/msg07692.html

As for your assertion that the specs are in conflict, yes, the Bearer spec includes a different decision than a RECOMMENDED clause in the HTTPbis spec (which was added after the Bearer text was already in place).  However, it is not violating any MUST clauses in the HTTPbis spec.  Given that no MUSTS are violated, I don't see it mandatory for this tension to be resolved in favor of one spec or the other in order for both to be approved as RFCs.  I look forward to seeing that happen soon in both cases (and for the OAuth core spec as well).

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

On 2011-12-29 22:18, Mike Jones wrote:
> You proposed, Julian "3. Do not specify the ABNF. The ABNF of the WWW-Authenticate is defined in HTTPbis. Just state the names of the parameters, their syntax *after* parsing and their semantics."
>
> About some of Mark Nottingham's comments, Barry wrote "Let me point out that "this represents working-group consensus" is not always a valid response.  If the working group has actually considered the *issue*, that might be OK.  But if there's consensus for the chosen solution and someone brings up a *new* issue with it, that issue needs to be addressed anew."
>
> Relative to these two statements, I believe that I should remark at this point that your proposed semantics of only considering the syntax after potential quoting was explicitly considered earlier by the working group and rejected.  The consensus, instead, was for the present "no quoting will occur for legal inputs" semantics.

It would be helpful if you could back this statement with pointers to mails. As far as I can tell it's just you disagreeing with me.

Back to the facts:

a) the bearer spec defines an HTTP authentication scheme, and normatively refers to HTTPbis Part7 for that

b) HTTPbis recommends new scheme definitions not to have their own ABNF, as the header field syntax is defined by HTTPbis, not the individual scheme

c) the bearer spec defines it's own ABNF nevertheless

So the two specs are in conflict, and we should resolve the conflict one way or the other.

If you disagree with the recommendation in HTTPbis, then you really really should come over to HTTPbis WG and argue your point of view.

If you agree with it, but think that the bearer spec can't follow the recommendation, then it would be good to explain the reasoning (optimally in the spec).

If you agree with it, and think the bearer spec *could* follow it, then... change it, by all means.

Anyway, if this issue isn't resolved before IETF LC then it will be raised again at that time.

> I believe that in the New Year the chairs and area directors will need to decide how to proceed on this issue.  (The working group consensus, as I see it, is already both well-informed and clear on this point, but I understand that that's not the only consideration.)  It would be good to see the spec finished shortly.
> ...

Best regards, Julian

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: William Mills <[email-masked]>
Date: Tue, 3 Jan 2012 11:44:39 -0800 (PST)

By "parameter syntax" I mean the syntax of the Authentication HTTP header.

________________________________
 From: William Mills <[email-masked]>
To: Mike Jones <[email-masked]>; Julian Reschke <[email-masked]> 
Cc: Mark Nottingham <[email-masked]>; Barry Leiba <[email-masked]>; OAuth WG <[email-masked]> 
Sent: Tuesday, January 3, 2012 11:35 AM
Subject: Re: [OAUTH-WG] auth-param syntax, was:  OK to post OAuth Bearer draft 15?

 

  - Justin Richer: 
 http://www.ietf.org/mail-archive/web/oauth/current/msg07692.html

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

On 2011-12-29 22:18, Mike Jones wrote:
> Relative to these two statements, I believe that I
 should remark at this point that your proposed semantics of only considering the syntax after potential quoting was explicitly considered earlier by the working group and rejected.  The consensus, instead, was for the present "no quoting will occur for legal inputs" semantics.

Back to the facts:

If you disagree with the recommendation in HTTPbis, then you really really should
 come over to HTTPbis WG and argue your point of view.

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Tue, 3 Jan 2012 19:46:37 +0000

This is about the syntax for the scope, error, and error_description parameters.  The pertinent text from Section 3 <http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-15#section-3> is:

   Producers of "scope" strings MUST NOT use characters outside the set
   %x21 / %x23-5B / %x5D-7E for representing the scope values and %x20
   for the delimiter.  Producers of "error" and "error_description"
   strings MUST NOT use characters outside the set %x20-21 / %x23-5B /
   %x5D-7E for representing these values.  Producers of "error-uri"
   strings MUST NOT use characters outside the set %x21 / %x23-5B /
   %x5D-7E for representing these values.  Furthermore, "error-uri"
   strings MUST conform to the URI-Reference syntax.  In all these
   cases, no character quoting will occur, as senders are prohibited
   from using the %5C ('\') character.

                                                            Cheers,
                                                            -- Mike

From: William Mills [mailto:[email-masked]]
Sent: Tuesday, January 03, 2012 11:36 AM
To: Mike Jones; Julian Reschke
Cc: Mark Nottingham; Barry Leiba; OAuth WG
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft 15?

________________________________
From: Mike Jones <[email-masked]<mailto:[email-masked]>>
To: Julian Reschke <[email-masked]<mailto:[email-masked]>>
Cc: Mark Nottingham <[email-masked]<mailto:[email-masked]>>; Barry Leiba <[email-masked]<mailto:[email-masked]>>; OAuth WG <[email-masked]<mailto:[email-masked]>>
Sent: Friday, December 30, 2011 3:19 PM
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft 15?

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: William Mills <[email-masked]>
Date: Tue, 3 Jan 2012 11:59:32 -0800 (PST)

Why is Bearer dealing with this at all?  the BNF for that stuff should be part of the core spec, and additional values perhaps defined in Bearer.

________________________________
 From: Mike Jones <[email-masked]>
To: William Mills <[email-masked]>; Julian Reschke <[email-masked]> 
Cc: Mark Nottingham <[email-masked]>; Barry Leiba <[email-masked]>; OAuth WG <[email-masked]> 
Sent: Tuesday, January 3, 2012 11:46 AM
Subject: RE: [OAUTH-WG] auth-param syntax, was:  OK to post OAuth Bearer draft 15?

This is about the syntax for the scope, error, and error_description parameters.  The pertinent text from Section 3 is:

                                                            Cheers,
                                                            -- Mike
 
From:William Mills [mailto:[email-masked]] 

 
From:Mike Jones <[email-masked]>

As for your assertion that the specs are in conflict, yes, the Bearer spec includes a different decision than a RECOMMENDED clause in the HTTPbis spec (which was added after the Bearer text was already in place).  However, it is not violating any MUST clauses
 in the HTTPbis spec.  Given that no MUSTS are violated, I don't see it mandatory for this tension to be resolved in favor of one spec or the other in order for both to be approved as RFCs.  I look forward to seeing that happen soon in both cases (and for the
 OAuth core spec as well).

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

On 2011-12-29 22:18, Mike Jones wrote:
> About some of Mark Nottingham's comments, Barry wrote "Let me point out that "this represents working-group consensus" is not always a valid response.  If the working group has actually considered the *issue*, that might be OK.  But if there's consensus for
 the chosen solution and someone brings up a *new* issue with it, that issue needs to be addressed anew."
>
> Relative to these two statements, I believe that I should remark at this point that your proposed semantics of only considering the syntax after potential quoting was explicitly considered earlier by the working group and rejected.  The consensus, instead,
 was for the present "no quoting will occur for legal inputs" semantics.

Back to the facts:

> I believe that in the New Year the chairs and area directors will need to decide how to proceed on this issue.  (The working group consensus, as I see it, is already both well-informed and clear on this point, but I understand that that's not the only consideration.) 
 It would be good to see the spec finished shortly.

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Tue, 3 Jan 2012 20:00:26 +0000

The core spec doesn't include these parameters.

Sent: Tuesday, January 03, 2012 12:00 PM

To: William Mills <[email-masked]<mailto:[email-masked]>>; Julian Reschke <[email-masked]<mailto:[email-masked]>>

                                                            Cheers,
                                                            -- Mike

From: William Mills [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

---

From: William Mills <[email-masked]>
Date: Tue, 3 Jan 2012 12:13:44 -0800 (PST)

http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-11.2.2 certainly has these as predefined registered parameters.  If the definition there isn't strong enough, or in that spec, we should fix that.  That is where these should be defined.

Sent: Tuesday, January 3, 2012 12:00 PM

The core spec doesn’t include these parameters.

 

                                                            Cheers,
                                                            -- Mike

 

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Tue, 3 Jan 2012 20:20:07 +0000

Sorry, I should have been more precise.  The Core spec doesn’t define how to transmit these fields in the WWW-Authenticate response header field.  The Bearer spec does.

                                                                -- Mike

Sent: Tuesday, January 03, 2012 12:14 PM

                                                            Cheers,
                                                            -- Mike

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

---

From: William Mills <[email-masked]>
Date: Tue, 3 Jan 2012 12:37:48 -0800 (PST)

OK, then the core spec should.

Sent: Tuesday, January 3, 2012 12:20 PM

 
                                                                -- Mike

 

 

                                                            Cheers,
                                                            -- Mike

 

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

---

From: John Bradley <[email-masked]>
Date: Wed, 4 Jan 2012 18:40:01 -0300

You are correct.  the Core spec should include this.  However for one reason or another it is not in the core spec and probably will not be, given that it is in last call.

One way or other we need to identify the correct answer.

John B.

---

From: Julian Reschke <[email-masked]>
Date: Wed, 04 Jan 2012 23:01:17 +0100

On 2012-01-04 22:40, John Bradley wrote:
> You are correct. the Core spec should include this. However for one
> reason or another it is not in the core spec and probably will not be,
> given that it is in last call.
> ...

The datatracker says:

"AD Evaluation::Revised ID Needed" 
(<https://datatracker.ietf.org/doc/draft-ietf-oauth-v2/>)

As far as I recall, this includes other changes needed by the bearer spec.

Best regards, Julian

---

From: John Bradley <[email-masked]>
Date: Wed, 4 Jan 2012 19:10:38 -0300

Don't get me wrong, I agree that it should be in core.

I just don't want to hold up core for something that only bearer seems to care about.

If there is consensus that it should be fixed in core then lets do that rather than leaving it up to bearer,  MAC and token types not yet imagined to do it independently.

John B.
On 2012-01-04, at 7:01 PM, Julian Reschke wrote:

> "AD Evaluation::Revised ID Needed" (<https://datatracker.ietf.org/doc/draft-ietf-oauth-v2/>)
>

---

From: Mike Jones <[email-masked]>
Date: Wed, 4 Jan 2012 22:17:02 +0000

There are actually two parts to "this" as I see it:
1.  Defining the syntax for the acceptable contents of the scope, error, error_description, and error_uri parameters.
2.  Defining the means by which these values are transmitted in WWW-Authenticate response header fields for Bearer tokens.

I would be fine seeing part 1 added to the core spec.  (In fact, there is a tracked issue OAuth ticket 27<http://trac.tools.ietf.org/wg/oauth/trac/ticket/27> requiring that this occur for the scope parameter.)  Given that the core spec is, by design, agnostic of the method used to access protected resource (including being agnostic of the use of the WWW-Authenticate field by the Bearer spec), I believe that it would be inappropriate to add part 2 to the core spec.

                                                                Cheers,
                                                                -- Mike

From: John Bradley [mailto:[email-masked]]
Sent: Wednesday, January 04, 2012 1:40 PM
To: William Mills
Cc: Mike Jones; Julian Reschke; Mark Nottingham; Barry Leiba; OAuth WG
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft 15?

John B.

Sorry, I should have been more precise.  The Core spec doesn't define how to transmit these fields in the WWW-Authenticate response header field.  The Bearer spec does.

                                                                -- Mike

                                                            Cheers,
                                                            -- Mike

                Best wishes,
                -- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft 15?

Back to the facts:

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 04 Jan 2012 23:22:09 +0100

On 2012-01-04 23:17, Mike Jones wrote:
> There are actually two parts to “this” as I see it:
>
> 1. Defining the syntax for the acceptable contents of the scope, error,
> error_description, and error_uri parameters.
>
> 2. Defining the means by which these values are transmitted in
> WWW-Authenticate response header fields for Bearer tokens.
>
> I would be fine seeing part 1 added to the core spec. (In fact, there is
> a tracked issue OAuth ticket 27
> <http://trac.tools.ietf.org/wg/oauth/trac/ticket/27> requiring that this
> occur for the scope parameter.) Given that the core spec is, by design,
> agnostic of the method used to access protected resource (including
> being agnostic of the use of the WWW-Authenticate field by the Bearer
> spec), I believe that it would be inappropriate to add part 2 to the
> core spec.
> ...

+1

---

From: William Mills <[email-masked]>
Date: Wed, 4 Jan 2012 15:43:35 -0800 (PST)

Then we need to make this a last call issue.

________________________________
 From: John Bradley <[email-masked]>
To: William Mills <[email-masked]> 
Cc: Mike Jones <[email-masked]>; Julian Reschke <[email-masked]>; Mark Nottingham <[email-masked]>; Barry Leiba <[email-masked]>; OAuth WG <[email-masked]> 
Sent: Wednesday, January 4, 2012 1:40 PM
Subject: Re: [OAUTH-WG] auth-param syntax, was:  OK to post OAuth Bearer draft 15?

John B.

---

From: William Mills <[email-masked]>
Date: Wed, 4 Jan 2012 15:44:41 -0800 (PST)

Does Bearer really have to go there?  Can it simply be pulled form Bearer?

________________________________
 From: John Bradley <[email-masked]>
To: Julian Reschke <[email-masked]> 
Cc: William Mills <[email-masked]>; Barry Leiba <[email-masked]>; Mark Nottingham <[email-masked]>; OAuth WG <[email-masked]> 
Sent: Wednesday, January 4, 2012 2:10 PM
Subject: Re: [OAUTH-WG] auth-param syntax, was:  OK to post OAuth Bearer draft 15?

John B.