Subject: Re: [OAUTH-WG] OAuth 2.0 Token Upgrade Extension

From: David Recordon <[email-masked]>
Date: Fri, 27 Aug 2010 20:26:29 +0000

This draft is now an Internet Draft and I'm curious if anyone has any
feedback on it?
http://tools.ietf.org/html/draft-recordon-oauth-v2-upgrade-00

I'd also like to request that this draft moves to become a Working Group
item. I'm am happy to act as the editor unless someone else wishes to do so
moving forward.

Thanks,
--David

On Mon, Jul 12, 2010 at 10:39 PM, David Recordon <[email-masked]>wrote:

> The ability to upgrade OAuth 1.0 tokens and secrets to OAuth 2.0 access
> tokens has come up on the list a few times. Attached is a draft assertion
> format which allows a client to trade an OAuth 1.0 token/secret pair for an
> OAuth 2.0 access token. The assertion format is a JSON object with values
> for the token and token secret. My goal is that this draft become a working
> group document.
>
> A question for the group is if upgrading multiple tokens at once is
> a necessary use case? The assertion format within the core spec only
> supports issuing a single access token. Facebook has a custom endpoint which
> allows upgrading multiple tokens at once, but I don't actually have data
> about how many developers make use of that functionality.
>
> Thanks,
> --David
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 27 Aug 2010 15:46:28 -0700

+1 on making this a WG item.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of David Recordon
Sent: Friday, August 27, 2010 1:26 PM
To: OAuth WG
Cc: Tschofenig, Hannes (NSN - FI/Espoo)
Subject: Re: [OAUTH-WG] OAuth 2.0 Token Upgrade Extension

This draft is now an Internet Draft and I'm curious if anyone has any feedback on it? http://tools.ietf.org/html/draft-recordon-oauth-v2-upgrade-00

I'd also like to request that this draft moves to become a Working Group item. I'm am happy to act as the editor unless someone else wishes to do so moving forward.

Thanks,
--David

On Mon, Jul 12, 2010 at 10:39 PM, David Recordon <[email-masked]<mailto:[email-masked]>> wrote:
The ability to upgrade OAuth 1.0 tokens and secrets to OAuth 2.0 access tokens has come up on the list a few times. Attached is a draft assertion format which allows a client to trade an OAuth 1.0 token/secret pair for an OAuth 2.0 access token. The assertion format is a JSON object with values for the token and token secret. My goal is that this draft become a working group document.

A question for the group is if upgrading multiple tokens at once is a necessary use case? The assertion format within the core spec only supports issuing a single access token. Facebook has a custom endpoint which allows upgrading multiple tokens at once, but I don't actually have data about how many developers make use of that functionality.

Thanks,
--David

---

From: "Manger, James H" <[email-masked]>
Date: Sun, 29 Aug 2010 23:26:13 +1000

Editorial: JSON strings use double quotes, not single quotes, so the example in section 2 "Assertion Request" should be:

...

assertion=%7B%22token%22%3A%22rjmaGaw9ATW%22%2C%22token_secret%22%3A%22OgFcfEjBR%22%7D&

...

--

James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of David Recordon
Sent: Saturday, 28 August 2010 6:26 AM
To: OAuth WG
Cc: Tschofenig, Hannes (NSN - FI/Espoo)
Subject: Re: [OAUTH-WG] OAuth 2.0 Token Upgrade Extension

Thanks,

--David

---

From: Bill de hÓra <[email-masked]>
Date: Mon, 30 Aug 2010 13:46:44 +0100

On Fri, 2010-08-27 at 20:26 +0000, David Recordon wrote:
> feedback on
> it? http://tools.ietf.org/html/draft-recordon-oauth-v2-upgrade-00
> 

replace

[[[
client_id
      REQUIRED.  The client identifier as described in Section 2 of
      [I-D.ietf.oauth-v2].

   client_secret
      REQUIRED.  The client secret as described in Section 2 of
      [I-D.ietf.oauth-v2].
]]]

with

{{{
client_id
      REQUIRED.  The client identifier as described in Section 2 of
      [I-D.ietf.oauth-v2], the value of which is the oauth_consumer_key
      as described in [@@@rfc5849]

   client_secret
      REQUIRED.  The client secret as described in Section 2 of
      [I-D.ietf.oauth-v2],the value of which is the shared-secret
      as described in "3.4 Signature" of [@@@rfc5849]
}}}

The draft needs to reference rfc5849 rather than OAuth 1.0.

Bill

---

From: Justin Richer <[email-masked]>
Date: Mon, 30 Aug 2010 10:16:46 -0400

I'm more in favor of this alternative:

[1] http://www.ietf.org/mail-archive/web/oauth/current/msg02300.html

But I can see use cases for both: they basically look at the same
problem from both sides. If Marius would like to bring his draft up to
current spec, I would support its inclusion as a WG item along side of
David's.

 -- Justin

On Fri, 2010-08-27 at 16:26 -0400, David Recordon wrote:
> I'd also like to request that this draft moves to become a Working
> Group item. I'm am happy to act as the editor unless someone else
> wishes to do so moving forward.
> 
> 
> Thanks,
> --David
> 
> 
>         The ability to upgrade OAuth 1.0 tokens and secrets to OAuth
>         2.0 access tokens has come up on the list a few times.
>         Attached is a draft assertion format which allows a client to
>         trade an OAuth 1.0 token/secret pair for an OAuth 2.0 access
>         token. The assertion format is a JSON object with values for
>         the token and token secret. My goal is that this draft become
>         a working group document.
>         
>         
>         A question for the group is if upgrading multiple tokens at
>         once is a necessary use case? The assertion format within the
>         core spec only supports issuing a single access token.
>         Facebook has a custom endpoint which allows upgrading multiple
>         tokens at once, but I don't actually have data about how many
>         developers make use of that functionality.
>         
>         
>         Thanks,
>         --David
> 
>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Mon, 30 Aug 2010 10:10:00 -0700

It does not need to have any normative references to 5849.

EHL

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Bill de hÓra
Sent: Monday, August 30, 2010 5:47 AM
To: David Recordon
Cc: Tschofenig, Hannes (NSN - FI/Espoo); OAuth WG
Subject: Re: [OAUTH-WG] OAuth 2.0 Token Upgrade Extension

replace

[[[
client_id

   client_secret

with

{{{
client_id

   client_secret
      REQUIRED.  The client secret as described in Section 2 of
      [I-D.ietf.oauth-v2],the value of which is the shared-secret
      as described in "3.4 Signature" of [@@@rfc5849] }}}

Bill

_______________________________________________
OAuth mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/oauth

---

From: Bill de hÓra <[email-masked]>
Date: Tue, 31 Aug 2010 11:12:47 +0100

Why not?

Bill

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Tue, 31 Aug 2010 11:12:02 -0700

Because 2.0 deployments are not likely to share the same credentials with 1.0, or at least it is not something I would like to suggest. This is a new protocol.

EHL

On 8/31/10 3:12 AM, "[email-masked]" <[email-masked]> wrote:

Why not?

Bill