Subject: [OAUTH-WG] Implementation Support and Community

From: Justin Richer <[email-masked]>
Date: Thu, 23 Aug 2012 10:38:14 -0400

With the core specs basically out the door and seeing wider adoption and 
publicity, the OAuth community is going to start to get more questions 
about "how do I do X?", and many of these are questions that have been 
answered before or seem "obvious" to those of us who have been up to our 
ears in the spec for the past few years. Nevertheless, these are 
important questions to support for the wellbeing of the protocol 
community, but where should they be asked?

When the OAuth community lived on a simple Google Group, these kinds of 
questions make sense. But I'd argue that the IETF list is not really the 
right place for them. This list, and the IETF in general, seems to be 
best suited for *building* the protocol, not for the *use* and *support* 
of said protocol once it's built.

The problem is that, as of right now, we don't have anywhere to point 
people where they could get a "real" answer.

This opens a larger question of who might "sponsor" or "host" such a 
community. Anything like that needs moderators, and more importantly, 
needs experts willing to answer the questions. Some options I can think of:

  - Revive the google groups list for these kinds of questions/discussions
  - Start a new list/forum, linked to oauth.net
  - Point everyone to StackOverflow with an "oauth" tag

  -- Justin (who is not volunteering himself to host or moderate the group)

---

From: John Bradley <[email-masked]>
Date: Thu, 23 Aug 2012 10:51:17 -0400

The openID foundation is in a position of promoting OAuth 2 now as a significant dependency of openID Connect and other work.

I can ask the board if there is a interest in hosting something specific for OAuth 2.   

I agree with Justin, now that the core spec is done there needs to be some consideration put to marketing and support by someone. 
This WG has new work items to progress so we probably don't want to get bogged down with that in this group.

I will wait to see the discussion on this here before asking OIDF or anyone else if they want to set something up.

John B.
On 2012-08-23, at 10:38 AM, Justin Richer wrote:

> With the core specs basically out the door and seeing wider adoption and publicity, the OAuth community is going to start to get more questions about "how do I do X?", and many of these are questions that have been answered before or seem "obvious" to those of us who have been up to our ears in the spec for the past few years. Nevertheless, these are important questions to support for the wellbeing of the protocol community, but where should they be asked?
> 
> When the OAuth community lived on a simple Google Group, these kinds of questions make sense. But I'd argue that the IETF list is not really the right place for them. This list, and the IETF in general, seems to be best suited for *building* the protocol, not for the *use* and *support* of said protocol once it's built.
> 
> The problem is that, as of right now, we don't have anywhere to point people where they could get a "real" answer.
> 
> This opens a larger question of who might "sponsor" or "host" such a community. Anything like that needs moderators, and more importantly, needs experts willing to answer the questions. Some options I can think of:
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Eve Maler <[email-masked]>
Date: Thu, 23 Aug 2012 19:49:06 -0700

Perhaps relatedly, in the UMA group we've been defining feature tests for interoperability testing, and since UMA uses OAuth, we wondered if any OAuth feature tests exist; we couldn't find any. That might be another activity worthy of being taken up by such a community. (Both UMA and OpenID Connect are using the OSIS.idcommons.net wiki for interop testing.)

	Eve

>> -- Justin (who is not volunteering himself to host or moderate the group)

Eve Maler                                  http://www.xmlgrrl.com/blog
+1 425 345 6756                         http://www.twitter.com/xmlgrrl

---

From: John Bradley <[email-masked]>
Date: Thu, 23 Aug 2012 23:02:52 -0400

Not that I know of beyond what we have as part of the openID Connect testing.   
A good number of those tests cover the underlying OAuth 2 flows.

It would not take too much to expand the FEDLAB test harness for more generic OAuth tests if there was a demand.

Though without a protocol to apply OAuth to the tests are more of a challenge.

John B.

---

From: Igor Faynberg <[email-masked]>
Date: Thu, 23 Aug 2012 23:14:34 -0400

An interesting thought!

It is true that interoperability testing is a requirement for an 
advancement of a Proposed Standard to Draft Standard, so surely OAuth 
interoperability testing must take place. I I don't recall test suits 
defined per se in the IETF. Not that it has not happened--it simply has 
not happened in the groups I worked in or followed.    I remember SIP 
bake-offs progressing well, but not tested to a specific test case set.

Very roughly, the use case document does identify pre- and post 
conditions, but this may not provide enough granularity. Maybe it can be 
used as a starting point though.

Igor

On 8/23/2012 10:49 PM, Eve Maler wrote:
> On 23 Aug 2012, at 7:51 AM, John Bradley<[email-masked]>  wrote:
>

---

From: Dick Hardt <[email-masked]>
Date: Thu, 23 Aug 2012 20:33:23 -0700

+1 to StackOverflow -- that has become the goto source for programming FAQs