Subject: [OAUTH-WG] OAuth Core -28 and Bearer -21 specs published

From: Mike Jones <[email-masked]>
Date: Wed, 20 Jun 2012 04:57:10 +0000

OAuth Core draft -28 has been published.  Changes were:

*        Updated the ABNF in the manner discussed by the working group, allowing username and password to be Unicode and restricting client_id and client_secret to ASCII.

*        Specifies the use of the application/x-www-form-urlencoded content-type encoding method to encode the client_id when used as the password for HTTP Basic.

OAuth Bearer draft -21 has also been published.  Changes were:

*        Changed "NOT RECOMMENDED" to "not recommended" in caveat about the URI Query Parameter method.

*        Changed "other specifications may extend this specification for use with other transport protocols" to "other specifications may extend this specification for use with other protocols".

*        Changed Acknowledgements to use only ASCII characters, per the RFC style guide.
The drafts are available at:

*        http://tools.ietf.org/html/draft-ietf-oauth-v2-28

*        http://tools.ietf.org/html/draft-ietf-oauth-v2-bearer-21

HTML-formatted versions are available at:

*        http://self-issued.info/docs/draft-ietf-oauth-v2-28.html

*        http://self-issued.info/docs/draft-ietf-oauth-v2-bearer-21.html

Thanks to Eran Hammer for approving the Core draft posting.

                                                            -- Mike

---

From: Julian Reschke <[email-masked]>
Date: Wed, 20 Jun 2012 09:13:02 +0200

On 2012-06-20 06:57, Mike Jones wrote:
> ·Updated the ABNF in the manner discussed by the working group, allowing
> username and password to be Unicode and restricting client_id and
> client_secret to ASCII.
>
> ·Specifies the use of the application/x-www-form-urlencoded content-type
> encoding method to encode the client_id when used as the password for
> HTTP Basic.
> ...

Well, you asked for feedback, you got it (repeatedly), and you ignore 
it. This is getting frustrating.

Best regards, Julian

---

From: Eran Hammer <[email-masked]>
Date: Wed, 20 Jun 2012 11:07:29 +0000

Julian - This is not the final draft. Mike pushed an update with the information available while I'm away. Another draft will follow next week. I will review the list and propose text (or ask questions) early next week.

EH

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Julian Reschke
> Sent: Wednesday, June 20, 2012 12:13 AM
> To: Mike Jones
> Cc: [email-masked]
> Subject: Re: [OAUTH-WG] OAuth Core -28 and Bearer -21 specs published
> 
> > *Updated the ABNF in the manner discussed by the working group,
> > allowing username and password to be Unicode and restricting client_id
> > and client_secret to ASCII.
> >
> > *Specifies the use of the application/x-www-form-urlencoded
> > content-type encoding method to encode the client_id when used as the
> > password for HTTP Basic.
> > ...
> 
> Well, you asked for feedback, you got it (repeatedly), and you ignore it. This
> is getting frustrating.
> 
> Best regards, Julian
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Julian Reschke <[email-masked]>
Date: Wed, 20 Jun 2012 13:19:09 +0200

> Julian - This is not the final draft. Mike pushed an update with the information available while I'm away. Another draft will follow next week. I will review the list and propose text (or ask quest…

OK, thanks for the update!

---

From: Mike Jones <[email-masked]>
Date: Wed, 20 Jun 2012 14:51:47 +0000

Julian, I don't believe that it's the intent of either Eran or myself to ignore your concerns - far from it.  That being said, what's frustrating from my personal perspective is that we've asked you to provide specific proposed text changes that would address your concerns several times and you don't do it.  It's probably just me, but I personally find the descriptions of your concerns vague and unclear - making it hard to make them actionable.  Specific proposed text changes would make them actionable.

Could you please provide specific changes for Eran's use for when he considers them on Monday?  I think it would help a lot.

				Thank you,
				-- Mike

-----Original Message-----
From: Eran Hammer [mailto:[email-masked]] 
Sent: Wednesday, June 20, 2012 4:07 AM
To: Julian Reschke; Mike Jones
Cc: [email-masked]
Subject: RE: [OAUTH-WG] OAuth Core -28 and Bearer -21 specs published

EH

> > allowing username and password to be Unicode and restricting 
> > client_id and client_secret to ASCII.
> >
> > content-type encoding method to encode the client_id when used as 
> > the password for HTTP Basic.
> > ...
>

---

From: Julian Reschke <[email-masked]>
Date: Wed, 20 Jun 2012 17:01:17 +0200

> Could you please provide specific changes for Eran's use for when he considers them on Monday?  I think it would help a lot.

Sorry, can't do that; not just because I don't have time but also 
because I don't understand the spec sufficiently do decide what needs to 
be done.

What's clear is that you can't silently mix ABNFs for byte sequences and 
character sequences. You need to be clear about what is what. I can't 
answer that. I provided you with a reference to similar text in a spec I 
wrote a few years ago; please borrow from it.

With respect to the POST/media-type/encoding issue I *did* make a 
concrete proposal.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Wed, 20 Jun 2012 18:40:36 +0200

> username and password to be Unicode and restricting client_id and

   VSCHAR     = %20-7E

needs to be

   VSCHAR     = %x20-7E

(note the missing "x").

Best regards, Julian