Subject: [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-22.txt

From: Alexey Melnikov <[email-masked]>
Date: Tue, 17 Jul 2012 12:04:38 +0100

I am still Ok with -22, but I have 1 new comment raised by introduction 
of the base64 ABNF non terminal:

I think it would be worth adding a comment for b64token that points to 
the base64 RFC. The current ABNF is too permissive (arbitrary number of 
"=" allowed at the end) and there are enough broken base64 parsers 
around (parsers that ignore everything after a "=", parsers that support 
arbitrary number of "=" at the end, etc.), so we shouldn't encourage 
creation of new ones.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 17 Jul 2012 12:12:23 +0100

Folks. Please don't develop any new revisions for these
documents right now. I know you can't officially post
'em anyway, but I don't want us to get tempted to roll
new versions handling unrelated comments. (Alexey's
comments are not unrelated.)

I'd like to handle any tweaks needed as RFC editor notes
if possible.

S

---

From: Mike Jones <[email-masked]>
Date: Tue, 17 Jul 2012 16:10:26 +0000

FYI, the b64 token definition is identical to the one in draft-ietf-httpbis-p7-auth-20.  If it works there, it should work for OAuth Bearer.

-- Mike

________________________________
From: Stephen Farrell
Sent: 7/17/2012 4:12 AM
To: [email-masked]
Cc: General Area Review Team; [email-masked]; The IESG
Subject: Re: [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-22.txt

S

> arbitrary number of "=" at the end, etc.), so we shouldn't encourage

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jul 2012 18:40:56 +0200

On 2012-07-17 18:10, Mike Jones wrote:
> FYI, the b64 token definition is identical to the one in
> draft-ietf-httpbis-p7-auth-20.  If it works there, it should work for
> OAuth Bearer.
> ...

+1; not every constraint needs to be expressed in the ABNF. "b64token" 
is here so recipients can parse the header field; it's up to the auth 
scheme to state what the addition constraints are; and that can happen 
in prose.

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 17 Jul 2012 18:02:13 +0100

> scheme to state what the addition constraints are; and that can happen 

I didn't say that it has to be expressed in ABNF (although I obviously 
wouldn't mind). I would like an ABNF comment pointing to the document 
which defines base64.

---

From: Mike Jones <[email-masked]>
Date: Tue, 17 Jul 2012 17:15:59 +0000

For clarity of discussion, the definition in question is:
     b64token    = 1*( ALPHA / DIGIT /
                       "-" / "." / "_" / "~" / "+" / "/" ) *"="

Note that b64token is a liberal syntax intended to permit base64 encoded content (hence the inclusion of the "+" and "/" characters and the optional trailing "=" characters), base64url encoded content (hence the inclusion of the "-" and "_" characters) and other URL-safe productions (hence the inclusion of the "." and "~" characters).

Its use is definitely not intended to be restricted to base64 encoded content, per RFC 4648. If it were so restricted (by not allowing ".", for instance), this would exclude the use of JWTs as bearer tokens, for instance, which is something we *definitely* want to allow.

As a result, I don't think adding a reference to RFC 4648 is either necessary or appropriate.

Julian may be able to provide more background.

				Best wishes,
				-- Mike

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Tuesday, July 17, 2012 10:02 AM
To: Julian Reschke; Mike Jones
Cc: The IESG; General Area Review Team; [email-masked]; [email-masked]; Stephen Farrell
Subject: Re: [Gen-art] [OAUTH-WG] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-22.txt

> scheme to state what the addition constraints are; and that can happen 

I didn't say that it has to be expressed in ABNF (although I obviously wouldn't mind). I would like an ABNF comment pointing to the document which defines base64.

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jul 2012 19:32:10 +0200

>       b64token    = 1*( ALPHA / DIGIT /

That is correct, in that the constraint on the token contents seems to 
be defined elsewhere.

That being said, by changing the reference from HTTPbis to 2617 you 
broke the spec:

    The "Authorization" header field uses the framework defined by
    HTTP/1.1 [RFC2617] as follows:

      b64token    = 1*( ALPHA / DIGIT /
                        "-" / "." / "_" / "~" / "+" / "/" ) *"="
      credentials = "Bearer" 1*SP b64token

...because in RFC 2617, exactly that syntax is not allowed:

      credentials = auth-scheme #auth-param
      auth-param     = token "=" ( token | quoted-string )

I have to say that I'm a bit surprised by that change (was there any 
public discussion about it?). It is probably possible to fix this 
without having to reference HTTPbis, but, I'm not totally sure about why 
you would want that.

(Note that the spec can be approved before HTTPbis, it just would have 
to wait for RFC publication a bit longer)

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Tue, 17 Jul 2012 17:39:28 +0000

Yes, the decision to remove normative references to HTTPbis was made during the public OAuth status call on Monday, July 9th, as the call participants wanted to be able to publish the RFC before HTTPbis is published as an RFC.

The sense on that call was that HTTPbis wouldn't be an RFC until near the end of this year or later.  If you have more data on that, it would be great to learn what the actual expected timeline is.

				Thanks,
				-- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Tuesday, July 17, 2012 10:32 AM
To: Mike Jones
Cc: Alexey Melnikov; General Area Review Team; The IESG; [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] [Gen-art] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-22.txt

>       b64token    = 1*( ALPHA / DIGIT /

That is correct, in that the constraint on the token contents seems to be defined elsewhere.

That being said, by changing the reference from HTTPbis to 2617 you broke the spec:

I have to say that I'm a bit surprised by that change (was there any public discussion about it?). It is probably possible to fix this without having to reference HTTPbis, but, I'm not totally sure about why you would want that.

(Note that the spec can be approved before HTTPbis, it just would have to wait for RFC publication a bit longer)

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jul 2012 19:48:20 +0200

> Yes, the decision to remove normative references to HTTPbis was made during the public OAuth status call on Monday, July 9th, as the call participants wanted to be able to publish the RFC before HT…

Well, it would have been nice to see this recorded in a mail to the 
mailing list.

> The sense on that call was that HTTPbis wouldn't be an RFC until near the end of this year or later.  If you have more data on that, it would be great to learn what the actual expected timeline is.

We all know well that it's extremely hard to make predictions like 
these, right?

So again: if you simply replace the dependency then you need to add 
prose explaining why you are using syntax that is not allowed per RFC 
2617. I would think it's easier to leave things as they were (and as 
last-called both in the WG LC and the IETF LC), and let the spec sit in 
the RFC Editor queue a bit longer (it would still be approved as 
Proposed Standard, just not published).

Best regards, Julian

---

From: Mike Jones <[email-masked]>
Date: Tue, 17 Jul 2012 17:54:10 +0000

The change and the reason for it were called out to the working group in http://www.ietf.org/mail-archive/web/oauth/current/msg09594.html.

What additional text would you propose that the RFC editor add to explain the deviance from RFC 2617?

				Thanks,
				-- Mike

-----Original Message-----
From: Julian Reschke [mailto:[email-masked]] 
Sent: Tuesday, July 17, 2012 10:48 AM
To: Mike Jones
Cc: General Area Review Team; The IESG; [email-masked]; [email-masked]
Subject: Re: [OAUTH-WG] [Gen-art] Gen-ART Telechat review of draft-ietf-oauth-v2-bearer-22.txt

> Yes, the decision to remove normative references to HTTPbis was made during the public OAuth status call on Monday, July 9th, as the call participants wanted to be able to publish the RFC before HT…

Well, it would have been nice to see this recorded in a mail to the mailing list.

> The sense on that call was that HTTPbis wouldn't be an RFC until near the end of this year or later.  If you have more data on that, it would be great to learn what the actual expected timeline is.

We all know well that it's extremely hard to make predictions like these, right?

So again: if you simply replace the dependency then you need to add prose explaining why you are using syntax that is not allowed per RFC 2617. I would think it's easier to leave things as they were (and as last-called both in the WG LC and the IETF LC), and let the spec sit in the RFC Editor queue a bit longer (it would still be approved as Proposed Standard, just not published).

Best regards, Julian

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 17 Jul 2012 18:57:46 +0100

>       b64token    = 1*( ALPHA / DIGIT /

In this case, can you please rename the production to something which is 
clearly not a base64 string.

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jul 2012 20:03:04 +0200

> The change and the reason for it were called out to the working group in http://www.ietf.org/mail-archive/web/oauth/current/msg09594.html.

Indeed, as fait accompli. There were four days between the telco and the 
publication of the new draft for actually reporting the planned changes 
to the WG.

> What additional text would you propose that the RFC editor add to explain the deviance from RFC 2617?

I would propose to undo the change.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 17 Jul 2012 20:42:17 +0200

On 2012-07-17 20:03, Julian Reschke wrote:
>> The change and the reason for it were called out to the working group
>> in http://www.ietf.org/mail-archive/web/oauth/current/msg09594.html.
>

Apologies, I now see that you indeed posted the proposed draft earlier. 
I didn't notice that.

I *did* participate in the beginning of the telco, and I'm still a bit 
surprised the topic didn't come up when I asked whether I can drop out 
of the call (after discussing the media type issue).

Best regards, Julian