[Ace] Last Call: (Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework) to Prop

[The IESG]

The IESG has received a request from the Authentication and Authorization for
Constrained Environments WG (ace) to consider the following document: -
'Notification of Revoked Access Tokens in the Authentication and
   Authorization for Constrained Environments (ACE) Framework'
   as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-c...@ietf.org mailing lists by 2024-04-05. Exceptionally, comments may
be sent to i...@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


   This document specifies a method of the Authentication and
   Authorization for Constrained Environments (ACE) framework, which
   allows an Authorization Server to notify Clients and Resource Servers
   (i.e., registered devices) about revoked access tokens.  As specified
   in this document, the method allows Clients and Resource Servers to
   access a Token Revocation List on the Authorization Server by using
   the Constrained Application Protocol (CoAP), with the possible
   additional use of resource observation.  Resulting (unsolicited)
   notifications of revoked access tokens complement alternative
   approaches such as token introspection, while not requiring
   additional endpoints on Clients and Resource Servers.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-ace-revoked-token-notification/



No IPR declarations have been submitted directly on this I-D.





___
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace

[Ace] AD review and IETF LC for draft-ietf-ace-revoked-token-notification

[Paul Wouters]

Hi,

I've done my AD review of  draft-ietf-ace-revoked-token-notification.

The document looks good, I only have a minor question, which can be
answered during the IETC LC process.


Section 13.2 states:

Issuing access tokens with not too long expiration time could
help reduce the size of the TRL, but an AS SHOULD take measures
to limit this size.

I don't really understand what this is trying to say. What "measures",
other than short expiry times, can an AS take ?


Paul
___
Ace mailing list
Ace@ietf.org
https://www.ietf.org/mailman/listinfo/ace