Discussion:
[OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata
Hannes Tschofenig
2017-03-07 18:45:30 UTC
Permalink
Hi all,

here is the write-up:
https://github.com/hannestschofenig/tschofenig-ids/blob/master/shepherd-writeups/Writeup_OAuth_Metadata.txt

I need your feedback on the following issues:

1) Implementation & deployment status of the spec

2) Working group summary (see below)
(Particularly asking Phil whether this is a correct summary.)

3) There are four normative references to non-IETF specifications (see
below). I am wondering whether these are indeed necessary (as normative
references).

4) Any other feedback?

Ciao
Hannes

----

Working Group Summary

Work on a discovery mechanism for OAuth was planned since a long
time but it took till late 2015 before a document was submitted
to the group, which re-used work done in the OpenID Foundation.
When the WGLC was started in 2016, see
https://www.ietf.org/mail-archive/web/oauth/current/msg15796.html,
feedback resulted in significant restructuring of the document.

Now, almost a year later these concerns have been resolved and
the document is ready for publication.


----

[UNICODE] The Unicode Consortium, "The Unicode Standard",
<http://www.unicode.org/versions/latest/>.

[USA15] Davis, M. and K. Whistler, "Unicode Normalization Forms",
Unicode Standard Annex 15, June 2015,
<http://www.unicode.org/reports/tr15/>.

[OAuth.Post]
Jones, M. and B. Campbell, "OAuth 2.0 Form Post Response
Mode", April 2015, <http://openid.net/specs/
oauth-v2-form-post-response-mode-1_0.html>.

[OAuth.Responses]
de Medeiros, B., Ed., Scurtescu, M., Tarjan, P., and M.
Jones, "OAuth 2.0 Multiple Response Type Encoding
Practices", February 2014,
<http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html>.
Mike Jones
2017-03-07 18:58:55 UTC
Permalink
Replies inline...

-----Original Message-----
From: OAuth [mailto:oauth-***@ietf.org] On Behalf Of Hannes Tschofenig
Sent: Tuesday, March 7, 2017 10:46 AM
To: ***@ietf.org; Phil Hunt <***@oracle.com>
Subject: [OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata

Hi all,

here is the write-up:
https://github.com/hannestschofenig/tschofenig-ids/blob/master/shepherd-writeups/Writeup_OAuth_Metadata.txt

I need your feedback on the following issues:

1) Implementation & deployment status of the spec

Microsoft has at least four deployments of the specification. William Denniss has said that Google uses the specification. I believe that Ping Identity also uses it. The specification is used by https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and https://tools.ietf.org/html/draft-ietf-oauth-device-flow-04.

2) Working group summary (see below)
(Particularly asking Phil whether this is a correct summary.)

Rather than saying "feedback resulted in significant restructuring of the document" I would say "feedback resulted in focusing the scope of the specification, removing everything except for the authorization server metadata, which remained unchanged".

3) There are four normative references to non-IETF specifications (see below). I am wondering whether these are indeed necessary (as normative references).

I believe that these normative references are all necessary, because they provide information necessary to implement normative portions of the specification.

4) Any other feedback?

Glad this is finishing!

Ciao
Hannes

----

Working Group Summary

Work on a discovery mechanism for OAuth was planned since a long
time but it took till late 2015 before a document was submitted
to the group, which re-used work done in the OpenID Foundation.
When the WGLC was started in 2016, see
https://www.ietf.org/mail-archive/web/oauth/current/msg15796.html,
feedback resulted in significant restructuring of the document.

Now, almost a year later these concerns have been resolved and
the document is ready for publication.


----

[UNICODE] The Unicode Consortium, "The Unicode Standard",
<http://www.unicode.org/versions/latest/>.

[USA15] Davis, M. and K. Whistler, "Unicode Normalization Forms",
Unicode Standard Annex 15, June 2015,
<http://www.unicode.org/reports/tr15/>.

[OAuth.Post]
Jones, M. and B. Campbell, "OAuth 2.0 Form Post Response
Mode", April 2015, <http://openid.net/specs/
oauth-v2-form-post-response-mode-1_0.html>.

[OAuth.Responses]
de Medeiros, B., Ed., Scurtescu, M., Tarjan, P., and M.
Jones, "OAuth 2.0 Multiple Response Type Encoding
Practices", February 2014, <http://openid.net/specs/oauth-v2-multiple-response-types-1_0.html>.
Hannes Tschofenig
2017-03-07 19:07:03 UTC
Permalink
Hi Mike

thanks for the quick response and for the wording suggestions.

Regarding the implementations are OpenID Connect implementations
required to implement this functionality?
Post by Hannes Tschofenig
1) Implementation & deployment status of the spec
Microsoft has at least four deployments of the specification.
William Denniss has said that Google uses the specification. I
believe that Ping Identity also uses it. The specification is used
by https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and
https://tools.ietf.org/html/draft-ietf-oauth-device-flow-04.
Ciao
Hannes
Mike Jones
2017-03-07 19:15:01 UTC
Permalink
OpenID Connect implementations are not required to implement this functionality but most do, by virtue of implementing the OpenID Connect metadata specified in https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata. The OAuth AS Metadata spec is intentionally compatible with this specification.

If you want to include the compatible OpenID Connect examples, there are 34 ASs and 9 clients listed at http://openid.net/certification/ that implement metadata compatible with the AS metadata specification. See the "Config OP" and "Config RP" columns.

The usage examples I provided in my previous reply were all OAuth examples that did not assume an implementation of OpenID Connect.

Best wishes,
-- Mike

-----Original Message-----
From: Hannes Tschofenig [mailto:***@gmx.net]
Sent: Tuesday, March 7, 2017 11:07 AM
To: Mike Jones <***@microsoft.com>; ***@ietf.org; Phil Hunt <***@oracle.com>
Subject: Re: [OAUTH-WG] Shepherd writeup for OAuth 2.0 Authorization Server Metadata

Hi Mike

thanks for the quick response and for the wording suggestions.

Regarding the implementations are OpenID Connect implementations required to implement this functionality?
Post by Hannes Tschofenig
1) Implementation & deployment status of the spec
Microsoft has at least four deployments of the specification.
William Denniss has said that Google uses the specification. I
believe that Ping Identity also uses it. The specification is used by
https://tools.ietf.org/html/draft-ietf-oauth-token-binding-01 and
https://tools.ietf.org/html/draft-ietf-oauth-device-flow-04.
Ciao
Hannes

Loading...