Subject: [OAUTH-WG] OAuth specs in IETF last call

From: Mike Jones <[email-masked]>
Date: Mon, 23 Jan 2012 17:11:38 +0000

FYI, the OAuth Core and Bearer specifications have reached IETF last call status - the last step before becoming RFCs.  See the following notes from the Internet Engineering Steering Group (IESG).

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of The IESG
Sent: Monday, January 23, 2012 7:44 AM
To: IETF-Announce
Cc: [email-masked]
Subject: [OAUTH-WG] Last Call: <draft-ietf-oauth-v2-23.txt> (The OAuth 2.0 Authorization Protocol) to Proposed Standard

The IESG has received a request from the Web Authorization Protocol WG
(oauth) to consider the following document:
- 'The OAuth 2.0 Authorization Protocol'
  <draft-ietf-oauth-v2-23.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the [email-masked] mailing lists by 2012-02-06. Exceptionally, comments may be sent to [email-masked] instead. In either case, please retain the beginning of the Subject line to allow automated sorting.

Abstract

   The OAuth 2.0 authorization protocol enables a third-party
   application to obtain limited access to an HTTP service, either on
   behalf of a resource owner by orchestrating an approval interaction
   between the resource owner and the HTTP service, or by allowing the
   third-party application to obtain access on its own behalf.  This
   specification replaces and obsoletes the OAuth 1.0 protocol described
   in RFC 5849.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-oauth-v2/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-oauth-v2/

No IPR declarations have been submitted directly on this I-D.

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of The IESG
Sent: Monday, January 23, 2012 7:47 AM
To: IETF-Announce
Cc: [email-masked]
Subject: [OAUTH-WG] Last Call: <draft-ietf-oauth-v2-bearer-15.txt> (The OAuth 2.0 Authorization Protocol: Bearer Tokens) to Proposed Standard

The IESG has received a request from the Web Authorization Protocol WG
(oauth) to consider the following document:
- 'The OAuth 2.0 Authorization Protocol: Bearer Tokens'
  <draft-ietf-oauth-v2-bearer-15.txt> as a Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the [email-masked] mailing lists by 2012-02-06. Exceptionally, comments may be sent to [email-masked] instead. In either case, please retain the beginning of the Subject line to allow automated sorting.

Abstract

   This specification describes how to use bearer tokens in HTTP
   requests to access OAuth 2.0 protected resources.  Any party in
   possession of a bearer token (a "bearer") can use it to get access to
   the associated resources (without demonstrating possession of a
   cryptographic key).  To prevent misuse, bearer tokens need to be
   protected from disclosure in storage and in transport.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-oauth-v2-bearer/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-oauth-v2-bearer/

No IPR declarations have been submitted directly on this I-D.

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 23 Jan 2012 17:32:55 +0000

> FYI, the OAuth Core and Bearer specifications have reached IETF last call status - the last step before becoming RFCs.  See the following notes from the Internet Engineering Steering Group (IESG).

Not quite the last step. There may be directorate reviews,
then IESG evaluation follows, then the RFC editor queue.

But we're getting there:-)

S

> Subject: [OAUTH-WG] Last Call:<draft-ietf-oauth-v2-23.txt>  (The OAuth 2.0 Authorization Protocol) to Proposed Standard
>
>
> Subject: [OAUTH-WG] Last Call:<draft-ietf-oauth-v2-bearer-15.txt>  (The OAuth 2.0 Authorization Protocol: Bearer Tokens) to Proposed Standard
>
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 23 Jan 2012 10:39:35 -0700

On 1/23/12 10:11 AM, Mike Jones wrote:
> FYI, the OAuth Core and Bearer specifications have reached IETF last
> call status - the last step before becoming RFCs.  See the following
> notes from the Internet Engineering Steering Group (IESG).

Well, "last step" might be a bit optimistic. :)

For those who aren't familiar with the process, the next steps are:

1. IETF Last Call, which lasts two weeks. This is essentially your last
opportunity to provide feedback!

2. During IETF Last Call, the documents will be reviewed by several
cross-area teams within the IETF, including folks like the "GEN-ART"
review team and the AppsDir. We'll expect at least some feedback from
those teams. And at this stage anyone in the Internet community can
provide feedback, too.

3. After IETF Last Call, this WG's document editors will work to address
any feedback we've received.

4. The documents will then be scheduled for disussion during an IESG
telechat. Before the telechat, all the members of the Internet
Engineering Steering Group will review the specs and also provide
feedback. If there are "DISCUSSES" and "COMMENTS" lodged then the
document editors will need to address those (often in concert with the
WG chairs). If some of those issues are substantive, the editors and
chairs might bring those issues back to the WG for more discussion.

5. Assuming the documents are approved by the IESG, they will then be
handed off to the RFC Editor team for final copy editing, proofreading,
reference checking, etc.

As you can see, because there are still many steps left in the process,
it might be a few months before these specs are published as RFCs.

Just so you know!

Peter

--
Peter Saint-Andre
https://stpeter.im/

---

From: Mike Jones <[email-masked]>
Date: Mon, 23 Jan 2012 17:42:42 +0000

Thanks Stephen and Peter, for the clarifications.  For what it's worth, I'd meant to send my note to a different alias, but now I'm glad to have heard from both of you on the remaining steps ahead as a result!

				Best wishes,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Peter Saint-Andre
Sent: Monday, January 23, 2012 9:40 AM
To: [email-masked]
Subject: Re: [OAUTH-WG] OAuth specs in IETF last call

1. IETF Last Call, which lasts two weeks. This is essentially your last opportunity to provide feedback!

2. During IETF Last Call, the documents will be reviewed by several cross-area teams within the IETF, including folks like the "GEN-ART"
review team and the AppsDir. We'll expect at least some feedback from those teams. And at this stage anyone in the Internet community can provide feedback, too.

3. After IETF Last Call, this WG's document editors will work to address any feedback we've received.

4. The documents will then be scheduled for disussion during an IESG telechat. Before the telechat, all the members of the Internet Engineering Steering Group will review the specs and also provide feedback. If there are "DISCUSSES" and "COMMENTS" lodged then the document editors will need to address those (often in concert with the WG chairs). If some of those issues are substantive, the editors and chairs might bring those issues back to the WG for more discussion.

5. Assuming the documents are approved by the IESG, they will then be handed off to the RFC Editor team for final copy editing, proofreading, reference checking, etc.

As you can see, because there are still many steps left in the process, it might be a few months before these specs are published as RFCs.

Just so you know!

Peter

---

From: Julian Reschke <[email-masked]>
Date: Wed, 25 Jan 2012 00:25:46 +0100

On 2012-01-23 18:39, Peter Saint-Andre wrote:
> ...

6. ...and then will have to wait until all normatively referenced drafts 
are ready, too.

Best regards, Julian