OK, then the core spec should.
________________________________
From: Mike Jones <michael.jo...@microsoft.com>
To: William Mills <wmi...@yahoo-inc.com>; Julian Reschke
<julian.resc...@gmx.de>
Cc: Mark Nottingham <m...@mnot.net>; Barry Leiba <barryle...@computer.org>;
OAuth WG <oauth@ietf.org>
Sent: Tuesday, January 3, 2012 12:20 PM
Subject: RE: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
Sorry, I should have been more precise. The Core spec doesn’t define how to
transmit these fields in the WWW-Authenticate response header field. The
Bearer spec does.
-- Mike
From:William Mills [mailto:wmi...@yahoo-inc.com]
Sent: Tuesday, January 03, 2012 12:14 PM
To: Mike Jones; Julian Reschke
Cc: Mark Nottingham; Barry Leiba; OAuth WG
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-11.2.2 certainly has
these as predefined registered parameters. If the definition there isn't
strong enough, or in that spec, we should fix that. That is where these should
be defined.
________________________________
From:Mike Jones <michael.jo...@microsoft.com>
To: William Mills <wmi...@yahoo-inc.com>; Julian Reschke
<julian.resc...@gmx.de>
Cc: Mark Nottingham <m...@mnot.net>; Barry Leiba <barryle...@computer.org>;
OAuth WG <oauth@ietf.org>
Sent: Tuesday, January 3, 2012 12:00 PM
Subject: RE: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
The core spec doesn’t include these parameters.
From:William Mills [mailto:wmi...@yahoo-inc.com]
Sent: Tuesday, January 03, 2012 12:00 PM
To: Mike Jones; Julian Reschke
Cc: Mark Nottingham; Barry Leiba; OAuth WG
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
Why is Bearer dealing with this at all? the BNF for that stuff should be part
of the core spec, and additional values perhaps defined in Bearer.
________________________________
From:Mike Jones <michael.jo...@microsoft.com>
To: William Mills <wmi...@yahoo-inc.com>; Julian Reschke
<julian.resc...@gmx.de>
Cc: Mark Nottingham <m...@mnot.net>; Barry Leiba <barryle...@computer.org>;
OAuth WG <oauth@ietf.org>
Sent: Tuesday, January 3, 2012 11:46 AM
Subject: RE: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
This is about the syntax for the scope, error, and error_description
parameters. The pertinent text from Section 3 is:
Producers of "scope" strings MUST NOT use characters outside the set
%x21 / %x23-5B / %x5D-7E for representing the scope values and %x20
for the delimiter. Producers of "error" and "error_description"
strings MUST NOT use characters outside the set %x20-21 / %x23-5B /
%x5D-7E for representing these values. Producers of "error-uri"
strings MUST NOT use characters outside the set %x21 / %x23-5B /
%x5D-7E for representing these values. Furthermore, "error-uri"
strings MUST conform to the URI-Reference syntax. In all these
cases, no character quoting will occur, as senders are prohibited
from using the %5C ('\') character.
Cheers,
-- Mike
From:William Mills [mailto:wmi...@yahoo-inc.com]
Sent: Tuesday, January 03, 2012 11:36 AM
To: Mike Jones; Julian Reschke
Cc: Mark Nottingham; Barry Leiba; OAuth WG
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
Is all this only around the scope parameter? My mail cited below is with
regards to the character set for a valid scope parameter, which we should be
able to define and then lean on the HTTPbis spec for the actual parameter
syntax.
________________________________
From:Mike Jones <michael.jo...@microsoft.com>
To: Julian Reschke <julian.resc...@gmx.de>
Cc: Mark Nottingham <m...@mnot.net>; Barry Leiba <barryle...@computer.org>;
OAuth WG <oauth@ietf.org>
Sent: Friday, December 30, 2011 3:19 PM
Subject: Re: [OAUTH-WG] auth-param syntax, was: OK to post OAuth Bearer draft
15?
I did already back the statement that this is the working group consensus with
the e-mails attached in this note sent to you on December 12, 2011:
- http://www.ietf.org/mail-archive/web/oauth/current/msg08042.html
But since that apparently wasn't convincing to you that this working group
decision represents more than "just me disagreeing with you", here are
references to individual messages referenced in the above e-mail:
- Eran Hammer-Lahav:
http://www.ietf.org/mail-archive/web/oauth/current/msg07698.html
- John Bradley:
http://www.ietf.org/mail-archive/web/oauth/current/msg07699.html
- William Mills:
http://www.ietf.org/mail-archive/web/oauth/current/msg07700.html
- Mike Jones:
http://www.ietf.org/mail-archive/web/oauth/current/msg07701.html
- Phil Hunt: http://www.ietf.org/mail-archive/web/oauth/current/msg07702.html
- Justin Richer:
http://www.ietf.org/mail-archive/web/oauth/current/msg07692.html
As for your assertion that the specs are in conflict, yes, the Bearer spec
includes a different decision than a RECOMMENDED clause in the HTTPbis spec
(which was added after the Bearer text was already in place). However, it is
not violating any MUST clauses
in the HTTPbis spec. Given that no MUSTS are violated, I don't see it
mandatory for this tension to be resolved in favor of one spec or the other in
order for both to be approved as RFCs. I look forward to seeing that happen
soon in both cases (and for the
OAuth core spec as well).
Best wishes,
-- Mike
-----Original Message-----
From: Julian Reschke [mailto:julian.resc...@gmx.de]
Sent: Friday, December 30, 2011 2:26 AM
To: Mike Jones
Cc: Barry Leiba; Mark Nottingham; OAuth WG
Subject: Re: auth-param syntax, was: [OAUTH-WG] OK to post OAuth Bearer draft
15?
On 2011-12-29 22:18, Mike Jones wrote:
> You proposed, Julian "3. Do not specify the ABNF. The ABNF of the
> WWW-Authenticate is defined in HTTPbis. Just state the names of the
> parameters, their syntax *after* parsing and their semantics."
>
> About some of Mark Nottingham's comments, Barry wrote "Let me point out that
> "this represents working-group consensus" is not always a valid response. If
> the working group has actually considered the *issue*, that might be OK. But
> if there's consensus for
the chosen solution and someone brings up a *new* issue with it, that issue
needs to be addressed anew."
>
> Relative to these two statements, I believe that I should remark at this
> point that your proposed semantics of only considering the syntax after
> potential quoting was explicitly considered earlier by the working group and
> rejected. The consensus, instead,
was for the present "no quoting will occur for legal inputs" semantics.
It would be helpful if you could back this statement with pointers to mails. As
far as I can tell it's just you disagreeing with me.
Back to the facts:
a) the bearer spec defines an HTTP authentication scheme, and normatively
refers to HTTPbis Part7 for that
b) HTTPbis recommends new scheme definitions not to have their own ABNF, as the
header field syntax is defined by HTTPbis, not the individual scheme
c) the bearer spec defines it's own ABNF nevertheless
So the two specs are in conflict, and we should resolve the conflict one way or
the other.
If you disagree with the recommendation in HTTPbis, then you really really
should come over to HTTPbis WG and argue your point of view.
If you agree with it, but think that the bearer spec can't follow the
recommendation, then it would be good to explain the reasoning (optimally in
the spec).
If you agree with it, and think the bearer spec *could* follow it, then...
change it, by all means.
Anyway, if this issue isn't resolved before IETF LC then it will be raised
again at that time.
> I believe that in the New Year the chairs and area directors will need to
> decide how to proceed on this issue. (The working group consensus, as I see
> it, is already both well-informed and clear on this point, but I understand
> that that's not the only consideration.)
It would be good to see the spec finished shortly.
> ...
Best regards, Julian
_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
