Re: [OAUTH-WG] Versioning

2010-07-14 Thread Eran Hammer-Lahav
Already in -10. EHL On Jul 14, 2010, at 14:46, Rob Richards rricha...@cdatazone.org wrote: Finally getting a chance to catchup and respond to this thread. Marius Scurtescu wrote: See comments bellow... On Fri, Jul 9, 2010 at 4:27 AM, Stefanie Dronia sdro...@gmx.de wrote: Hallo

Re: [OAUTH-WG] Versioning

2010-07-14 Thread Marius Scurtescu
On Wed, Jul 14, 2010 at 11:46 AM, Rob Richards rricha...@cdatazone.org wrote: Finally getting a chance to catchup and respond to this thread. Marius Scurtescu wrote: See comments bellow... On Fri, Jul 9, 2010 at 4:27 AM, Stefanie Dronia sdro...@gmx.de wrote: Hallo Marius, thanks for

Re: [OAUTH-WG] Versioning

2010-07-08 Thread Marius Scurtescu
at the latest, the resource server doesn't support OAuth 1 anymore. Original-Nachricht Datum: Tue, 6 Jul 2010 21:54:16 -0700 Von: Marius Scurtescu mscurte...@google.com An: Rob Richards rricha...@cdatazone.org CC: oauth@ietf.org oauth@ietf.org Betreff: Re: [OAUTH-WG] Versioning

Re: [OAUTH-WG] Versioning

2010-07-03 Thread Rob Richards
To: Eran Hammer-Lahav Cc: oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning Eran Hammer-Lahav wrote: [Replying to everything at once...] -Original Message- From: Rob Richards [mailto:rricha...@cdatazone.org] Sent: Thursday, July 01, 2010 11:43 AM Exactly. While

Re: [OAUTH-WG] Versioning

2010-07-02 Thread Eran Hammer-Lahav
-Original Message- From: Rob Richards [mailto:rricha...@cdatazone.org] Sent: Friday, July 02, 2010 4:05 AM To: Eran Hammer-Lahav Cc: oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning Eran Hammer-Lahav wrote: [Replying to everything at once...] -Original Message- From: Rob

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
On Thu, Jul 1, 2010 at 9:35 AM, Eran Hammer-Lahav e...@hueniverse.com wrote: Hi Rob, -Original Message- From: Rob Richards [mailto:rricha...@cdatazone.org] Sent: Thursday, July 01, 2010 3:26 AM To: OAuth WG (oauth@ietf.org); Eran Hammer-Lahav Subject: Versioning Versioning is

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
(oauth@ietf.org) Subject: Re: [OAUTH-WG] Versioning Hi Rob, -Original Message- From: Rob Richards [mailto:rricha...@cdatazone.org] Sent: Thursday, July 01, 2010 3:26 AM To: OAuth WG (oauth@ietf.org); Eran Hammer-Lahav Subject: Versioning Versioning is still something

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
Message- From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf Of Marius Scurtescu Sent: Thursday, July 01, 2010 10:37 AM To: Eran Hammer-Lahav Cc: OAuth WG (oauth@ietf.org) Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 9:35 AM, Eran Hammer-Lahav e

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
: Thursday, July 01, 2010 10:49 AM To: Eran Hammer-Lahav; Rob Richards; oauth@ietf.org Subject: RE: [OAUTH-WG] Versioning My feeling on this is that versioning explicitly in the protocol adds clarity and some small level of compatibility. Different auth and token endpoints are easy, what's

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
[mailto:oauth-boun...@ietf.org] On Behalf Of Eran Hammer-Lahav Sent: Thursday, July 01, 2010 10:57 AM To: Marius Scurtescu Cc: OAuth WG (oauth@ietf.org) Subject: Re: [OAUTH-WG] Versioning -Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
Basic for client credentials, not to log-in an end-user. EHL -Original Message- From: William Mills [mailto:wmi...@yahoo-inc.com] Sent: Thursday, July 01, 2010 11:08 AM To: Eran Hammer-Lahav; Rob Richards; oauth@ietf.org Subject: RE: [OAUTH-WG] Versioning Why is using the string Token

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
-Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:16 AM To: Eran Hammer-Lahav Cc: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 10:59 AM, Eran Hammer-Lahav e

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 10:59 AM, Eran Hammer-Lahav e...@hueniverse.com wrote: Why is a version better than a new scheme name? Sure, but then make the scheme more specific. What will the scheme name be for OAuth 3? When tokens are passed

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
Message- From: William Mills [mailto:wmi...@yahoo-inc.com] Sent: Thursday, July 01, 2010 11:08 AM To: Eran Hammer-Lahav; Rob Richards; oauth@ietf.org Subject: RE: [OAUTH-WG] Versioning Why is using the string Token better than OAuth2?  1.0 used Oauth. If it's purely a question of aesthetics

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
EHL -Original Message- From: William Mills [mailto:wmi...@yahoo-inc.com] Sent: Thursday, July 01, 2010 10:49 AM To: Eran Hammer-Lahav; Rob Richards; oauth@ietf.org Subject: RE: [OAUTH-WG] Versioning My feeling on this is that versioning explicitly in the protocol adds

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 11:19 AM, Eran Hammer-Lahav e...@hueniverse.com wrote: I think HTTP authentication schemes should be generally useful. In this case, OAuth defines a few ways to obtain an token, and a few ways

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Rob Richards
Eran Hammer-Lahav wrote: -Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 10:37 AM To: Eran Hammer-Lahav Cc: Rob Richards; OAuth WG (oauth@ietf.org) Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 9:35 AM, Eran Hammer

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
-Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:36 AM To: Eran Hammer-Lahav Cc: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 11:24 AM, Eran Hammer-Lahav e

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
On Thu, Jul 1, 2010 at 11:42 AM, William Mills wmi...@yahoo-inc.com wrote: -Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:36 AM To: Eran Hammer-Lahav Cc: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
- From: Eran Hammer-Lahav [mailto:e...@hueniverse.com] Sent: Thursday, July 01, 2010 11:42 AM To: Marius Scurtescu Cc: William Mills; Rob Richards; oauth@ietf.org Subject: RE: [OAUTH-WG] Versioning It was and this approach was rejected by this group as confusing. At this point, it's

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Justin Richer
Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:16 AM To: Eran Hammer-Lahav Cc: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 10:59 AM, Eran Hammer-Lahav e...@hueniverse.com

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Justin Richer
...@google.com] Sent: Thursday, July 01, 2010 11:36 AM To: Eran Hammer-Lahav Cc: William Mills; Rob Richards; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu, Jul 1, 2010 at 11:24 AM, Eran Hammer-Lahav e...@hueniverse.com wrote: If you would like to discuss a version

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
On Thu, Jul 1, 2010 at 12:07 PM, Justin Richer jric...@mitre.org wrote: OAuth tokens as a form-encoded element in a post body? Yes. Keep it. Just curious. What use case would require that the access token is put in the post body as opposed to an http header when accessing a protected resource?

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Justin Richer
OAuth tokens as a form-encoded element in a post body? Yes. Keep it. Just curious. What use case would require that the access token is put in the post body as opposed to an http header when accessing a protected resource? If nothing else, it parallels the use case of a GET-style query

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Marius Scurtescu
On Thu, Jul 1, 2010 at 12:38 PM, Justin Richer jric...@mitre.org wrote: OAuth tokens as a form-encoded element in a post body? Yes. Keep it. Just curious. What use case would require that the access token is put in the post body as opposed to an http header when accessing a protected

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
The rest of the parameters being in the body. EHL -Original Message- From: oauth-boun...@ietf.org [mailto:oauth-boun...@ietf.org] On Behalf Of Marius Scurtescu Sent: Thursday, July 01, 2010 12:26 PM To: Justin Richer Cc: oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning On Thu

Re: [OAUTH-WG] Versioning

2010-07-01 Thread Eran Hammer-Lahav
[Replying to everything at once...] -Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:36 AM Not sure about the future, but looking at OAuth 1 vs OAuth 2. A protected resource request filter may want to decide early what

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
-Lahav Sent: Thursday, July 01, 2010 2:24 PM To: oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning [Replying to everything at once...] -Original Message- From: Marius Scurtescu [mailto:mscurte...@google.com] Sent: Thursday, July 01, 2010 11:36 AM Not sure about the future

Re: [OAUTH-WG] Versioning

2010-07-01 Thread William Mills
] On Behalf Of William Mills Sent: Thursday, July 01, 2010 2:36 PM To: Eran Hammer-Lahav; oauth@ietf.org Subject: Re: [OAUTH-WG] Versioning In re: 1. Token syntax 2. Presence of 'oauth_signature_method' 3. Presence of 'oauth_signature' 4. Presence of no other 'oauth_