Subject: [saag] OAUTH summary (part 1) at IETF-86

From: Derek Atkins <[email-masked]>
Date: Thu, 14 Mar 2013 13:09:33 -0400

OAUTH met on Monday for its first session of the week; we meet again
right after SAAG.  We've updated our milestones based on completed
documents and expectations for future document completion.

The first discussion was about the fact that OAUTH has been creating
frameworks instead of protocols, and the IESG has felt there has not
been enough detail to have interoperable implementations.  This led
directly into a discussion of the assertion framework and the SAML
tokens, and what can be done to improve the situation (e.g. addition
defintions of how to compare fields).

Next we discussed the Dynamic Registration protocol, but the document
requires more changes and is not ready for WGLC.

Last discussion was about testing.  This brought us back to the
implementation details.  There was a point made about RFC2119 as
conformance vs protocol definitions and how to use that in a test
plan, but in the end all were agreed that Roland is doing it right.
There is an open question about whether we can hold an Interop versus
setting up an online test suite.

More discussion will happen today after SAAG when we plan to discuss
JWT and the security requirements.

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant