Subject: [rtcweb] Alexey Melnikov's Discuss on draft-ietf-rtcweb-security-arch-18: (with DISCUSS)

From: Alexey Melnikov <[email-masked]>
Date: Tue, 05 Mar 2019 01:52:48 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-rtcweb-security-arch-18: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-security-arch/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for a well written document!

My apologies for filing a procedural DISCUSS on this, but I am looking at:

7.5.  Determining the IdP URI

   3.  The path, starting with "/.well-known/idp-proxy/" and appended
       with the IdP protocol.  Note that the separator characters '/'
       (%2F) and '\' (%5C) MUST NOT be permitted in the protocol field,
       lest an attacker be able to direct requests outside of the
       controlled "/.well-known/" prefix.  Query and fragment values MAY
       be used by including '?' or '#' characters.

"idp-proxy" is not registered in the IANA's
<https://www.iana.org/assignments/well-known-uris/well-known-uris.xhtml>
registry and this document doesn't register it either. If I missed where this
is registered, please point me to the right document. If I haven't, please
register it in this document.

---

From: Adam Roach <[email-masked]>
Date: Wed, 6 Mar 2019 13:37:14 -0600

> register it in this document.

Good catch! Thanks.

/a

---

From: Sean Turner <[email-masked]>
Date: Thu, 7 Mar 2019 10:31:22 +0900

> On Mar 7, 2019, at 04:37, Adam Roach <[email-masked]> wrote:
> 

I submitted a PR:
https://github.com/rtcweb-wg/security-arch/pull/86/files
And fired off a message to the expert list.

spt

---

From: Sean Turner <[email-masked]>
Date: Tue, 26 Mar 2019 11:28:26 +0100

> On Mar 7, 2019, at 02:31, Sean Turner <[email-masked]> wrote:
> 
> 
> 

The response from the DE:

From: Mark Nottingham <[email-masked]>
Date: Thu, 14 Mar 2019 14:53:35 +1100
Cc: [email-masked],
 [email-masked]
To: Sean Turner <[email-masked]>

Looks fine to me, although it'd be better to refer to 5785bis.

> On 7 Mar 2019, at 12:30 pm, Sean Turner <[email-masked]> wrote:
>
> Hi! We=E2=80=99re looking to register idp-proxy.  It=E2=80=99s used =
in:
> We forgot to register it (Alexey caught it) and I submitted the
> following PR to add it:
> Let us know what you think.
>
> spt
> _______________________________________________
> wellknown-uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wellknown-uri-review

---

From: Adam Roach <[email-masked]>
Date: Tue, 26 Mar 2019 14:14:34 +0100

Thanks, Sean.

I have already given Sean this guidance, but for the benefit of others: 
at this point, I am imposing a moratorium on adding any new normative 
dependencies from Cluster 238 documents to any works in progress, 
regardless of their level of maturity.

In this case: if RFC 5785bis completes prior to publication of 
rtcweb-security-arch, the RFC editor will (as a matter of practice) ask 
the authors whether they want to update the reference. If it does not, 
we do not want to block publication of the rest of the cluster on it.

/a