[OAUTH-WG] OAuth2 abstract

"Manger, James H" <James.H.Manger@team.telstra.com> Thu, 17 March 2011 02:39 UTC

From: "Manger, James H" <James.H.Manger@team.telstra.com>
To: OAuth WG <oauth@ietf.org>
Date: Thu, 17 Mar 2011 13:40:26 +1100
Thread-Topic: OAuth2 abstract
Thread-Index: AcvkTKvuSZ2d8pW/RJaZcWcOl5CEaw==
Message-ID: <255B9BB34FB7D647A506DC292726F6E1127FBD267F@WSMSG3153V.srv.dir.telstra.com>
Accept-Language: en-US, en-AU
Content-Language: en-US
acceptlanguage: en-US, en-AU
Content-Type: multipart/alternative; boundary="_000_255B9BB34FB7D647A506DC292726F6E1127FBD267FWSMSG3153Vsrv_"
MIME-Version: 1.0
Subject: [OAUTH-WG] OAuth2 abstract
Precedence: list

Comments on draft-ietf-oauth-v2-13:



1. Abstract

The 1-line abstract is not helpful - it merely repeats the title. The abstract is important as it is the text most widely seem around the rest of the IETF community (eg in announcements of drafts and RFCs) and beyond. It needs to mention: users delegating access to applications; applications orchestrating that delegation; swapping permanent credentials for short-lived access tokens; and that it uses HTTP. Here is my suggestion:



  "The OAuth 2.0 authorization protocol allows an application to gain
  limited permission to access an HTTP service on behalf of a user by
  orchestrating an approval interaction between the user and the service.
  OAuth 2.0 uses temporary credentials, issued by an HTTP service either
  directly to an application or to represent user-delegated permissions.
  A collection of HTTP services can accept temporary credentials without
  needing to handle long-term user or application credentials, which
  can be restricted to a secure service that issues the temporary
  credentials."



I think this text can be understood without knowing any of the specialised terms introduced later in the specification.





--

James Manger

[OAUTH-WG] OAuth2 abstract Manger, James H