Subject: [webfinger] New restriction added in WebFinger -13 needs to be relaxed or clarified

From: Mike Jones <[email-masked]>
Date: Wed, 17 Apr 2013 17:29:35 +0000

This new paragraph was added in WebFinger -13:

The host to which a WebFinger query is issued is significant.  If the query target contains a "host" portion (Section 3.2.2 of RFC 3986), then the host to which the WebFinger query is issued MUST be the same as the "host" portion of the query target. If the query target does not contain a "host" portion, then the client MAY choose a host to which it directs the query based on local policy.

I'm concerned that this paragraph just ruled out using WebFinger to query for account identifiers at a host that contain another hostname in the account identifier.  This is not a hypothetical situation.  For instance, I have a Google account whose identifier is [email-masked]<mailto:[email-masked]>.  It appears that the new paragraph makes this well-formed and useful query illegal:

GET /.well-known/webfinger?resource=acct%3Ambj%40microsoft.com HTTP/1.1
Host: google.com

I believe that the new paragraph either needs to be removed or clarified in some manner to make it clear that a WebFinger server may respond to resources that it is authoritative for even if the resource being queried contains a different domain name.

Another example of a situation where one domain is authoritative for others is Microsoft's Internet mail service domains.  At various times, the preferred domain has been msn.com, hotmail.com, live.com, and outlook.com.  It's perfectly reasonable to query for an identifier containing msn.com at live.com, for instance.

I'd suggest replacing this paragraph with something like the following instead:

The host to which a WebFinger query is issued is significant.  Different hosts hold authoritative information for different identifiers.  WebFinger servers MUST NOT supply information for identifiers that they are not authoritative for.  Note, however, that a WebFinger server at one domain may be authoritative for identifiers containing another domain.  For instance the server example.com may host an account whose identifier is acct:[email-masked], and queries may be sent to the WebFinger server at example.com about the account acct:[email-masked] that is hosted there.

                                                                -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul E. Jones
Sent: Tuesday, April 16, 2013 7:56 PM
To: [email-masked]
Subject: [webfinger] FW: New Version Notification - draft-ietf-appsawg-webfinger-13.txt

FYI

> -----Original Message-----

> From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]

> Sent: Tuesday, April 16, 2013 10:54 PM

> To: [email-masked]<mailto:[email-masked]>; draft-ietf-appsawg-

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>;

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>;

> [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

> Subject: New Version Notification -

> draft-ietf-appsawg-webfinger-13.txt

> A new version (-13) has been submitted for draft-ietf-appsawg-webfinger:

> http://www.ietf.org/internet-drafts/draft-ietf-appsawg-webfinger-13.tx

> t

> Sub state has been changed to AD Followup from Revised ID Needed

> The IETF datatracker page for this Internet-Draft is:

> https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/

> Diff from previous version:

> http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-webfinger-13

> IETF Secretariat.

_______________________________________________

webfinger mailing list

[email-masked]<mailto:[email-masked]>

https://www.ietf.org/mailman/listinfo/webfinger

---

From: Barry Leiba <[email-masked]>
Date: Wed, 17 Apr 2013 14:08:37 -0400

Mike, you have not followed the discussion outline: this isn't sent to
sufficient recipients to get to the right people.

+++ ACTION: Appsawg Chairs +++
I've added more recipients here, and this is asking the appsawg chairs
to add this to the issue list, to be brought up in its turn.  Please
see my messages about the DISCUSS positions to get the discussion
parameters.

Thanks,
Barry

On Wed, Apr 17, 2013 at 1:29 PM, Mike Jones <[email-masked]> wrote:
> The host to which a WebFinger query is issued is significant.  If the query
> target contains a “host” portion (Section 3.2.2 of RFC 3986), then the host
> to which the WebFinger query is issued MUST be the same as the “host”
> portion of the query target. If the query target does not contain a “host”
> portion, then the client MAY choose a host to which it directs the query
> based on local policy.
>
>
>
> I’m concerned that this paragraph just ruled out using WebFinger to query
> for account identifiers at a host that contain another hostname in the
> account identifier.  This is not a hypothetical situation.  For instance, I
> have a Google account whose identifier is [email-masked].  It appears
> that the new paragraph makes this well-formed and useful query illegal:
>
>
>
> I believe that the new paragraph either needs to be removed or clarified in
> some manner to make it clear that a WebFinger server may respond to
> resources that it is authoritative for even if the resource being queried
> contains a different domain name.
>
>
>
> Another example of a situation where one domain is authoritative for others
> is Microsoft’s Internet mail service domains.  At various times, the
> preferred domain has been msn.com, hotmail.com, live.com, and outlook.com.
> It’s perfectly reasonable to query for an identifier containing msn.com at
> live.com, for instance.
>
>
>
> I’d suggest replacing this paragraph with something like the following
> instead:
>
>
>
> The host to which a WebFinger query is issued is significant.  Different
> hosts hold authoritative information for different identifiers.  WebFinger
> servers MUST NOT supply information for identifiers that they are not
> authoritative for.  Note, however, that a WebFinger server at one domain may
> be authoritative for identifiers containing another domain.  For instance
> the server example.com may host an account whose identifier is
> acct:[email-masked], and queries may be sent to the WebFinger server at
> example.com about the account acct:[email-masked] that is hosted there.
>
>
>
>                                                                 -- Mike
>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 17 Apr 2013 14:59:27 -0400

Mike,

Could you elaborate on the use case for such a URI?  How would someone come
across your "acct" URI and know to send the query to Google?

The reason that text was added was to answer two questions:
1. How does a client know what server to send a WebFinger request to? and
2. How does a user know what WebFinger servers are giving out his
information?

If you want to relax the restriction, you'll need to provide answers to
those questions.

--Richard

On Wed, Apr 17, 2013 at 2:08 PM, Barry Leiba <[email-masked]>wrote:

> > It’s perfectly reasonable to query for an identifier containing msn.comat
> > live.com, for instance.
> >
> >
> >

---

From: nov matake <[email-masked]>
Date: Thu, 18 Apr 2013 09:55:46 +0900

Does this text allow HTTP redirects at the webfinger endpoints?
Or when a webfinger endpoint want to redirect the user agent, does it have to omit "host" query?

nov

On Apr 18, 2013, at 2:29 AM, Mike Jones <[email-masked]> wrote:

> The host to which a WebFinger query is issued is significant.  If the query target contains a “host” portion (Section 3.2.2 of RFC 3986), then the host to which the WebFinger query is issued MUST be the same as the “host” portion of the query target. If the query target does not contain a “host” portion, then the client MAY choose a host to which it directs the query based on local policy.
>  
> I’m concerned that this paragraph just ruled out using WebFinger to query for account identifiers at a host that contain another hostname in the account identifier.  This is not a hypothetical situation.  For instance, I have a Google account whose identifier is [email-masked].  It appears that the new paragraph makes this well-formed and useful query illegal:
>  
> Another example of a situation where one domain is authoritative for others is Microsoft’s Internet mail service domains.  At various times, the preferred domain has been msn.com, hotmail.com, live.com, and outlook.com.  It’s perfectly reasonable to query for an identifier containing msn.com at live.com, for instance.
>  
> I’d suggest replacing this paragraph with something like the following instead:
>  
> > From: [email-masked] [mailto:[email-masked]]
> > To: [email-masked]; draft-ietf-appsawg-
> > [email-masked]; [email-masked];
> > [email-masked]; [email-masked]; [email-masked];
> > [email-masked]; [email-masked]
> [email-masked]
> [email-masked]

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Apr 2013 01:58:51 -0400

Mike,

This and other changes were made as a part of the DISCUSSion this past week.

Your interpretation is correct.  The problem trying to be solved was one of
clarifying where a client would direct a request.  I think it's obvious to
me and you that if we were writing a client to query
acct:[email-masked], we'd direct the query to packetizer.com.
However, this was not stated, nor was guidance given as to where one directs
a request when there is no host portion in the URI (e.g., "tel").

If we introduce the text you propose, then the next question might be how
one domain becomes authoritative for another domain.  More importantly, your
proposed wording removes the key statements the ADs were trying to make, and
that is guidance on how to determine where a query should be directed.

Perhaps you would like to just "soften" the wording, such as "query is
normally issued" or something?  Or, perhaps say "unless a client is
explicitly configured to direct queries elsewhere, ."? 

Now, what this text does not intend to suggest is that 3xx redirection no
longer works.  If you have an msn.com account and the msn.com server wants
that handled by the live.com server, it could redirect the HTTP request.

So, what do we do here?

Paul

From: Mike Jones [mailto:[email-masked]] 
Sent: Wednesday, April 17, 2013 1:30 PM
To: Paul E. Jones; [email-masked]
Subject: New restriction added in WebFinger -13 needs to be relaxed or
clarified

The host to which a WebFinger query is issued is significant.  If the query
target contains a "host" portion (Section 3.2.2 of RFC 3986), then the host
to which the WebFinger query is issued MUST be the same as the "host"
portion of the query target. If the query target does not contain a "host"
portion, then the client MAY choose a host to which it directs the query
based on local policy.

I'm concerned that this paragraph just ruled out using WebFinger to query

Another example of a situation where one domain is authoritative for others
is Microsoft's Internet mail service domains.  At various times, the
preferred domain has been msn.com, hotmail.com, live.com, and outlook.com.
It's perfectly reasonable to query for an identifier containing msn.com at
live.com, for instance.

I'd suggest replacing this paragraph with something like the following
instead:

                                                                -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Paul E. Jones
Sent: Tuesday, April 16, 2013 7:56 PM
To: [email-masked]
Subject: [webfinger] FW: New Version Notification -
draft-ietf-appsawg-webfinger-13.txt

FYI

> From:  <mailto:[email-masked]> [email-masked] [
<mailto:[email-masked]> mailto:[email-masked]]

> To:  <mailto:[email-masked]> [email-masked];
draft-ietf-appsawg- 

>  <mailto:[email-masked]> [email-masked];
<mailto:[email-masked]> [email-masked]; 

>  <mailto:[email-masked]> [email-masked];
<mailto:[email-masked]> [email-masked];
<mailto:[email-masked]> [email-masked]; 

>  <mailto:[email-masked]> [email-masked];  <mailto:[email-masked]>
[email-masked]

>  <http://www.ietf.org/internet-drafts/draft-ietf-appsawg-webfinger-13.tx>

>  <https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/>

>  <http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-webfinger-13>

 

webfinger mailing list

 <mailto:[email-masked]> [email-masked]

 <https://www.ietf.org/mailman/listinfo/webfinger>
https://www.ietf.org/mailman/listinfo/webfinger

---

From: "Paul E. Jones" <[email-masked]>
Date: Thu, 18 Apr 2013 03:36:55 -0400

The intent of the new text was to help the UA determine where to direct the query.  Redirection is still permitted and the Location: header would dictate how the request is redirected, not the query target value.

Paul

From: nov matake [mailto:[email-masked]] 
Sent: Wednesday, April 17, 2013 8:56 PM
To: Mike Jones
Cc: Paul E. Jones; [email-masked]
Subject: Re: [webfinger] New restriction added in WebFinger -13 needs to be relaxed or clarified

nov

                                                                -- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul E. Jones
Sent: Tuesday, April 16, 2013 7:56 PM
To: [email-masked]
Subject: [webfinger] FW: New Version Notification - draft-ietf-appsawg-webfinger-13.txt

FYI

> From:  <mailto:[email-masked]> [email-masked] [ <mailto:[email-masked]> mailto:[email-masked]]

> To:  <mailto:[email-masked]> [email-masked]; draft-ietf-appsawg- 

>  <mailto:[email-masked]> [email-masked];  <mailto:[email-masked]> [email-masked]; 

>  <mailto:[email-masked]> [email-masked];  <mailto:[email-masked]> [email-masked];  <mailto:[email-masked]> [email-masked]; 

>  <mailto:[email-masked]> [email-masked];  <mailto:[email-masked]> [email-masked]

>  <http://www.ietf.org/internet-drafts/draft-ietf-appsawg-webfinger-13.tx> http://www.ietf.org/internet-drafts/draft-ietf-appsawg-webfinger-13.tx

>  <https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/> https://datatracker.ietf.org/doc/draft-ietf-appsawg-webfinger/

>  <http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-webfinger-13> http://www.ietf.org/rfcdiff?url2=draft-ietf-appsawg-webfinger-13

 

webfinger mailing list

 <https://www.ietf.org/mailman/listinfo/webfinger> https://www.ietf.org/mailman/listinfo/webfinger

---

From: Barry Leiba <[email-masked]>
Date: Thu, 18 Apr 2013 11:15:22 -0400

> one domain becomes authoritative for another domain.
...
> Perhaps you would like to just “soften” the wording, such as “query is
> normally issued” or something?  Or, perhaps say “unless a client is
> explicitly configured to direct queries elsewhere, …”?

I think it's not as simple as this, because many domains are using the
user's email address as an account name.  That email address can be on
any arbitrary domain, so authority doesn't enter into it.  This needs
some significant discussion to sort it out.

Let's please not have that discussion now; let's follow the discussion
management, and know that we've recorded this as an issue that will
come up in its turn.  Thanks.

Barry, Applications AD

On Thu, Apr 18, 2013 at 1:58 AM, Paul E. Jones <[email-masked]> wrote:
> clarifying where a client would direct a request.  I think it’s obvious to
> acct:[email-masked], we’d direct the query to packetizer.com.
> a request when there is no host portion in the URI (e.g., “tel”).
>
> Perhaps you would like to just “soften” the wording, such as “query is
> normally issued” or something?  Or, perhaps say “unless a client is
> explicitly configured to direct queries elsewhere, …”?
>