Subject: [OAUTH-WG] Provisional OAuth enhancements

From: Evan Gilbert <[email-masked]>
Date: Mon, 10 May 2010 16:50:13 -0700

I'm seeing a few OAuth features in spec discussions which:
- Feel like it would be a major omission if they don't make it into OAuth
2.0, but
- Haven't been used previously or even prototyped, which makes people
uncomfortable with adding to the spec

This includes the scope / sites syntax discussion (among others).

I'm wondering if there would any interest in collaborating on a Wiki for
"provisional" spec enhancements. The goal would be have a place for early
implementers to share a spec- these changes would not go into the OAuth 2.0
draft until we have implementation experienc. However discussions would
still be on the main mailing list.

On Mon, May 10, 2010 at 4:11 PM, Brian Eaton <[email-masked]> wrote:

> On Mon, May 10, 2010 at 7:32 AM, Manger, James H
> <[email-masked]> wrote:
> > HTTP Digest uses (A) [A. List of URI prefixes]. (A) is a pretty good
> match to how Google uses scope
> > values.
>
> It's not, actually.  Our scopes are sometimes URI prefixes, and
> sometimes are not.  The reality is complicated, and to be honest is
> poorly documented.  We're working on it.
>
> As I've said in a few other e-mail threads, I think it would be a
> serious mistake to publish a standard that doesn't reflect things that
> are already deployed in the wild and are well-understood.
>
> If people want to see systems that automatically determines scopes and
> reuses tokens, I think they should go and build those systems.  Then
> come back to the community with explanations of what they did, and why
> other people should adopt it.
>
> Cheers,
> Brian
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>

---

From: David Recordon <[email-masked]>
Date: Mon, 10 May 2010 18:28:03 -0700

If you're volunteering to draft text, then go for it. Otherwise I'm
unclear what you're actually proposing...

And we do have an implementation of scope in the wild. See "Requesting
Extended Permissions" on
http://developers.facebook.com/docs/authentication/.

--David

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 10 May 2010 20:05:28 -0700

I don't see how moving the discussion/work on these features elsewhere will help reach consensus on them. If someone has an idea that fails to get momentum on this list, they should work harder or reach out to the key people on this list in private and try to talk them into supporting it. Back-channels are an important tool of creating a standard (as long as all decisions are always made on the public list).

But I'm not going to stop anyone from playing with the wiki... (or publish their own extension I-D).

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Evan Gilbert
Sent: Monday, May 10, 2010 4:50 PM
To: Brian Eaton
Cc: OAuth WG ([email-masked])
Subject: [OAUTH-WG] Provisional OAuth enhancements

I'm seeing a few OAuth features in spec discussions which:
- Feel like it would be a major omission if they don't make it into OAuth 2.0, but
- Haven't been used previously or even prototyped, which makes people uncomfortable with adding to the spec

I'm wondering if there would any interest in collaborating on a Wiki for "provisional" spec enhancements. The goal would be have a place for early implementers to share a spec- these changes would not go into the OAuth 2.0 draft until we have implementation experienc. However discussions would still be on the main mailing list.

On Mon, May 10, 2010 at 4:11 PM, Brian Eaton <[email-masked]<mailto:[email-masked]>> wrote:
On Mon, May 10, 2010 at 7:32 AM, Manger, James H
<[email-masked]<mailto:[email-masked]>> wrote:
> HTTP Digest uses (A) [A. List of URI prefixes]. (A) is a pretty good match to how Google uses scope
> values.

Cheers,
Brian
_______________________________________________
OAuth mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/oauth

---

From: Brian Eaton <[email-masked]>
Date: Tue, 11 May 2010 09:24:19 -0700

On Mon, May 10, 2010 at 8:05 PM, Eran Hammer-Lahav <[email-masked]> wrote:
> I don’t see how moving the discussion/work on these features elsewhere will
> help reach consensus on them.

I think the proposal is to keep discussion on the IETF mailing list,
but clearly separate things that are speculative from things that are
known to be practical.

There have been a few cases where speculative things have nearly
gotten included in the core spec, which seems fairly dangerous to me.

> But I’m not going to stop anyone from playing with the wiki… (or publish
> their own extension I-D).

That's the idea.

---

From: Evan Gilbert <[email-masked]>
Date: Wed, 12 May 2010 11:01:29 -0700

OK, just started this experiment :)
- Added a section on the OAuth IETF Wiki for proposed enhancements:
http://trac.tools.ietf.org/wg/oauth/trac/wiki/OAuth2ProvisionalEnhancements.
- First proposal is for "username" parameter:
http://trac.tools.ietf.org/wg/oauth/trac/wiki/OAuth2UsernameParameter. If
you support immediate mode you probably want to use this parameter or come
up with an alternate approach for ensuring the same user is logged in.

Please consider adding enhancements to this Wiki when we don't have
implementation experience.

Cheers,
Evan