Subject: [secdir] SECDIR review of draft-ietf-oauth-discovery-07

From: Donald Eastlake <[email-masked]>
Date: Tue, 24 Oct 2017 22:31:49 -0400

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  Document
editors and WG chairs should treat these comments just like any other last
call comments.

The summary of the review is draft is ready with one nit.

This draft defines a metadata format that an OAuth 2.0 client can use to
obtain the information needed to interact with an OAuth 2.0 authorization
server, including its endpoint locations and authorization server
capabilities.

While I am not deeply familiar with this area of security technology, the
extensive Security Considerations section seems thorough and correct as far
as I can see.

Nit: The reference to RFC 5226 should probably be updated to RFC 8126

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270 <(508)%20333-2270> (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Mike Jones <[email-masked]>
Date: Fri, 27 Oct 2017 20:33:46 +0000

Thanks, Donald.  I’ll do the update to 8126 in the next draft.

                                                                -- Mike

From: Donald Eastlake [mailto:[email-masked]]
Sent: Tuesday, October 24, 2017 7:32 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: SECDIR review of draft-ietf-oauth-discovery-07

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  Document editors and WG chairs should treat these comments just like any other last call comments.

This draft defines a metadata format that an OAuth 2.0 client can use to obtain the information needed to interact with an OAuth 2.0 authorization server, including its endpoint locations and authorization server capabilities.

While I am not deeply familiar with this area of security technology, the extensive Security Considerations section seems thorough and correct as far as I can see.

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   +1-508-333-2270<tel:(508)%20333-2270> (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]<mailto:[email-masked]>