Subject: [saag] OAuth summary for IETF 81

From: Barry Leiba <[email-masked]>
Date: Thu, 28 Jul 2011 12:08:41 -0400

The OAuth base protocol and the bearer token documents began
working-group last call as of the Wednesday morning session, ending on
12 August.

The SAML document has been split into a general "assertions" document
and SAML-specific items; the former seems ready, and the latter now
has to be trimmed.  That's due on 12 August.

The threat-model document needs one more revision before working-group
last call.

We discussed a recent liaison statement from OMA that asks the OAuth
WG for a response.  The chairs will draft a response, and have already
received input for that.

Phil Hunt presented a summary of an issue on "sidejacking" the OAuth
exchange, if it's not properly secured (TLS in every part).  The
current version of the base protocol draft has tightened the language
acceptably.

Thomas Hardjono gave a presentation on UMA, with a plan to ask the WG
to consider this when we recharter (currently planned around October
or so).

-- Barry, OAuth chair