Subject: [OAUTH-WG] On the OAuth Core Spec

From: Derek Atkins <[email-masked]>
Date: Tue, 12 Jun 2012 13:28:27 -0400

Eran (and the rest of the OAuth WG),

Hannes and I would like to apologize for what transpired last week with
the publication of version 27 of the OAuth core specification.  It was
not our intention to get a document published behind your back, the goal
was the get a document published in a more timely manner than it
appeared you could provide.  Coincidentally there was a communication
breakdown where we had an expectation that your co-authors would keep
you in the loop about what was going on.  We clearly should have been
more proactive in doing that ourselves instead of expecting others to do
it for us.  Moreover, I was not privy to any agreement that you may have
had about being "sole editor", so I had no reason to believe that there
would have been any particular issue with getting another version of the
draft out when you were busy.  So, we're sorry.

We're also sorry we weren't more clear that we really did need to get a
draft out.  I'll be sure that Hannes and I are both more clear going
forward when there are timely dependencies.

Having said that, are you still willing and able to be the editor of
this draft and see it to its conclusion and publication?  If so, we will
need to get another draft out by this Friday (June 15), and I suspect
we'll need another draft that solves the encoding issue (brought up by
the ABNF exercise), targeting Friday, June 29th.  Do you think you can
make these target dates (assuming that there is text for you to apply to
the draft)?

Thanks, and again, our apologies,

-derek, co-chair

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Eran Hammer <[email-masked]>
Date: Tue, 12 Jun 2012 18:52:38 +0000

Derek - Thank you for this note. It is very much appreacited.

> From: Derek Atkins [mailto:[email-masked]]
> Sent: Tuesday, June 12, 2012 10:28 AM

> Having said that, are you still willing and able to be the editor of this draft and
> see it to its conclusion and publication?

Yes.

> If so, we will need to get another
> draft out by this Friday (June 15), and I suspect we'll need another draft that
> solves the encoding issue (brought up by the ABNF exercise), targeting
> Friday, June 29th.  Do you think you can make these target dates (assuming
> that there is text for you to apply to the draft)?

There are two main open issues I'm aware of:

1. Error registry text

* The text provided by Mike Jones for section 7.2 is unlcear. I have provided feedback on the list and am waiting to hear back from Mike (or anyone else). Once I understand the actual intention of the new normative language, I will rework the text to reflect those changes. While I have strong objections to the error code registry in genreal, once decided, my only goal is to ensure the text is clear, complete, and reflects working group consensus. I do not have strong interest in how the working group resolves the rules around the registry as long as they are clear and practical. The current text for 7.2 is not.

* In the consensus call for the error registry, Hannes requested (or suggested, it wasn't clear given the context) that the registry be implemented by IANA using separate tables. This requires prose changes to instruct IANA as such. Without changes, IANA will create a single table which is not what was requested. I have not seen much discussion on this. I am waiting for the chairs to clarify this and for someone to provide text if this is still the case (I have sent multiple emails on this to the list).

2. ABNF

* Mike Jones is doing solid work progressing the ABNF forward with the guidance of Julian. I trust Julian blindly to guide the text to a successful conculsion and the working group seems enaged. As soon as new text is available, I will incorporate and publish. If a schedule conflict arises in which I am unable to push the ABNF changes, I have no objections to Mike Jones pushing a new draft with only ABNF related change after quick coordination (Mike can submit using my contact and I'll approve it within a few hours).

I also have a short list of nits and typos reported to the list and me directly over the past few weeks which are all insignificant to list.

I am available to publish another draft on or by 6/14, and again on or by 6/27 (or 6/30 after my travel). I will be travelling on the exact dates listed. I am hoping that these dates are flexible within a few days range. In order for me to publish a new draft by 6/14, I will need the changes a day before to prepare. If the changes are ABNF only, I can work with Mike Jones to arrange it without putting my travel restriction in the way. I need the chairs to clarify what is expected in each of these drafts and how they seek to resolve the issues around item #1 above to continue.

Again, thanks for the note.

EH

---

From: SM <[email-masked]>
Date: Tue, 12 Jun 2012 13:22:32 -0700

Hi Derek, Hannes, Eran,

Thanks,
-sm

---

From: William Mills <[email-masked]>
Date: Tue, 12 Jun 2012 16:19:07 -0700 (PDT)

If endpoint discovery is to be via WebFinger (LRDD/XRD) we need there relations defined for the OAuth endpoints  I had that in http://tools.ietf.org/id/draft-ietf-kitten-sasl-oauth-00.txt section 7.3, but I've ripped all the discover stuff out of there.

This seems more appropriate in the OAuth 2 core spec, but it's really late to put it there.  Should it get added as part of the WF draft?  As a separate I-D with just the IANA registry items?

-bill

---

From: "Derek Atkins" <[email-masked]>
Date: Tue, 12 Jun 2012 20:06:22 -0400

Hi,

On Tue, June 12, 2012 7:19 pm, William Mills wrote:
> If endpoint discovery is to be via WebFinger (LRDD/XRD) we need there
> relations defined for the OAuth endpoints  I had that in
> http://tools.ietf.org/id/draft-ietf-kitten-sasl-oauth-00.txt section 7.3,
> but I've ripped all the discover stuff out of there.
>
> This seems more appropriate in the OAuth 2 core spec, but it's really late
> to put it there.  Should it get added as part of the WF draft?  As a
> separate I-D with just the IANA registry items?

I think it's a little late to add this to the core spec now.

I would say that you should just write up a separate draft that has the
IANA registry items and other ancillary data necessary. It could probably
go through as an informational draft, too, and possibly even an individual
submission.

> -bill

-derek

---

From: William Mills <[email-masked]>
Date: Tue, 12 Jun 2012 17:11:57 -0700 (PDT)

OK.  I'll do that.  Not hard.  

Will folks want to discuss the individual submission here?  Or will that be in apps-discuss?

Is it informational if it does IANA registry actions?

Thanks,

-bill

>________________________________
> From: Derek Atkins <[email-masked]>
>To: William Mills <[email-masked]> 
>Cc: "[email-masked]" <[email-masked]> 
>Sent: Tuesday, June 12, 2012 5:06 PM
>Subject: Re: [OAUTH-WG] Oauth 2 and discovery
> 
>Hi,
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 14 Jun 2012 21:18:06 +0000

FYI, Eran, I'm going to hold off sending you proposed updated ABNF text for a few more days to let the discussions continue and consensus to build.  I'm currently mentally targeting sending proposed draft updates Monday.

				Best wishes,
				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eran Hammer
Sent: Tuesday, June 12, 2012 11:53 AM
To: Derek Atkins
Cc: [email-masked]
Subject: Re: [OAUTH-WG] On the OAuth Core Spec

> this draft and see it to its conclusion and publication?

Yes.

> draft out by this Friday (June 15), and I suspect we'll need another 
> draft that solves the encoding issue (brought up by the ABNF 
> exercise), targeting Friday, June 29th.  Do you think you can make 
> these target dates (assuming that there is text for you to apply to the draft)?

1. Error registry text

2. ABNF

EH
_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Eran Hammer <[email-masked]>
Date: Thu, 14 Jun 2012 21:22:28 +0000

Sounds good.

Any progress on a revised 7.2? I'd like to get clarity on that so we can agree on new text and close the issue along with the ABNF.

EH

> From: Mike Jones [mailto:[email-masked]]
> Sent: Thursday, June 14, 2012 2:18 PM
> To: Eran Hammer
> Cc: [email-masked]
> Subject: RE: On the OAuth Core Spec
> 
> FYI, Eran, I'm going to hold off sending you proposed updated ABNF text for
> a few more days to let the discussions continue and consensus to build.  I'm
> currently mentally targeting sending proposed draft updates Monday.
> 
> 				Best wishes,
> 				-- Mike
> 
> * The text provided by Mike Jones for section 7.2 is unlcear. I have provided
> feedback on the list and am waiting to hear back from Mike (or anyone else).
> Once I understand the actual intention of the new normative language, I will
> rework the text to reflect those changes. While I have strong objections to
> the error code registry in genreal, once decided, my only goal is to ensure the
> text is clear, complete, and reflects working group consensus. I do not have
> strong interest in how the working group resolves the rules around the
> registry as long as they are clear and practical. The current text for 7.2 is not.
> 
> * In the consensus call for the error registry, Hannes requested (or
> suggested, it wasn't clear given the context) that the registry be
> implemented by IANA using separate tables. This requires prose changes to
> instruct IANA as such. Without changes, IANA will create a single table which
> is not what was requested. I have not seen much discussion on this. I am
> waiting for the chairs to clarify this and for someone to provide text if this is
> still the case (I have sent multiple emails on this to the list).
> 
> 2. ABNF
> 
> * Mike Jones is doing solid work progressing the ABNF forward with the
> guidance of Julian. I trust Julian blindly to guide the text to a successful
> conculsion and the working group seems enaged. As soon as new text is
> available, I will incorporate and publish. If a schedule conflict arises in which I
> am unable to push the ABNF changes, I have no objections to Mike Jones
> pushing a new draft with only ABNF related change after quick coordination
> (Mike can submit using my contact and I'll approve it within a few hours).
> 
> I also have a short list of nits and typos reported to the list and me directly
> over the past few weeks which are all insignificant to list.
> 
> I am available to publish another draft on or by 6/14, and again on or by 6/27
> (or 6/30 after my travel). I will be travelling on the exact dates listed. I am
> hoping that these dates are flexible within a few days range. In order for me
> to publish a new draft by 6/14, I will need the changes a day before to
> prepare. If the changes are ABNF only, I can work with Mike Jones to arrange
> it without putting my travel restriction in the way. I need the chairs to clarify
> what is expected in each of these drafts and how they seek to resolve the
> issues around item #1 above to continue.
>

---

From: Mike Jones <[email-masked]>
Date: Thu, 14 Jun 2012 21:43:24 +0000

I'm thinking about what the appropriate updates to 7.2 are.  Your question about "What if the parameter is named 'err' rather than 'error'?" is a fair one, for instance.  I'll also target proposed updates to that for Monday.

As to the question of one OAuth Errors registry versus four, as I suspect you saw, I've asked Hannes to withdraw his suggestion to split the one registry into four.  Hopefully that can be resolved soon too.

				-- Mike

-----Original Message-----
From: Eran Hammer [mailto:[email-masked]] 
Sent: Thursday, June 14, 2012 2:22 PM
To: Mike Jones
Cc: [email-masked]
Subject: RE: On the OAuth Core Spec

Sounds good.

EH

> FYI, Eran, I'm going to hold off sending you proposed updated ABNF 
> text for a few more days to let the discussions continue and consensus 
> to build.  I'm currently mentally targeting sending proposed draft updates Monday.
> 
> 				Best wishes,
> 				-- Mike
> 
> > these target dates (assuming that there is text for you to apply to 
> > the
> draft)?
> 
> * The text provided by Mike Jones for section 7.2 is unlcear. I have 
> provided feedback on the list and am waiting to hear back from Mike (or anyone else).
> Once I understand the actual intention of the new normative language, 
> I will rework the text to reflect those changes. While I have strong 
> objections to the error code registry in genreal, once decided, my 
> only goal is to ensure the text is clear, complete, and reflects 
> working group consensus. I do not have strong interest in how the 
> working group resolves the rules around the registry as long as they are clear and practical. The current text for 7.2 is not.
> 
> implemented by IANA using separate tables. This requires prose changes 
> to instruct IANA as such. Without changes, IANA will create a single 
> table which is not what was requested. I have not seen much discussion 
> on this. I am waiting for the chairs to clarify this and for someone 
> to provide text if this is still the case (I have sent multiple emails on this to the list).
> 
> 2. ABNF
> 
> guidance of Julian. I trust Julian blindly to guide the text to a 
> successful conculsion and the working group seems enaged. As soon as 
> new text is available, I will incorporate and publish. If a schedule 
> conflict arises in which I am unable to push the ABNF changes, I have 
> no objections to Mike Jones pushing a new draft with only ABNF related 
> change after quick coordination (Mike can submit using my contact and I'll approve it within a few hours).
> 
> I also have a short list of nits and typos reported to the list and me 
> directly over the past few weeks which are all insignificant to list.
> 
> I am available to publish another draft on or by 6/14, and again on or 
> by 6/27 (or 6/30 after my travel). I will be travelling on the exact 
> dates listed. I am hoping that these dates are flexible within a few 
> days range. In order for me to publish a new draft by 6/14, I will 
> need the changes a day before to prepare. If the changes are ABNF 
> only, I can work with Mike Jones to arrange it without putting my 
> travel restriction in the way. I need the chairs to clarify what is 
> expected in each of these drafts and how they seek to resolve the issues around item #1 above to continue.
>