[http-auth] drafty http-auth wg charter

Sean Turner <turners@ieca.com> Thu, 13 September 2012 19:28 UTC

Message-ID: <505233C6.1010000@ieca.com>
Date: Thu, 13 Sep 2012 15:28:06 -0400
From: Sean Turner <turners@ieca.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:15.0) Gecko/20120824 Thunderbird/15.0
MIME-Version: 1.0
To: http-auth@ietf.org
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [http-auth] drafty http-auth wg charter
Precedence: list

I'm glad to see there's some interest in an http-auth BOF.  With the 
deadlines fast approaching, I'd like jump start the charter discussions 
by providing a drafty wg charter.  Feel free to use this or not.

spt

--------

HTTP authentication [ref] is currently used for user authentication by 
some web sites. While form-based user authentication is currently much 
more commonly used, there is utility in providing better documentation 
for existing HTTP user authentication schemes that are in use, and for 
documenting experimental HTTP user authentication schemes that might 
offer security benefits for future uses.

The httpbis WG recently issued a call for proposals [ref] for HTTP 
authentication schemes as part of its work in further developing HTTP, 
including work on HTTP/2.0.  While a number of proposals were made, 
[ref] there is at present no consensus to adopt any of those as 
standards-track work items within the httpbis WG.

The http-auth WG will develop a set of informational or experimental 
RFCs for HTTP user authentication schemes that could, following 
experimentation, be widely adopted as standards-track schemes for HTTP 
user authentication.

All schemes to be developed in the http-auth WG must be usable with the 
existing HTTP authentication framework, [ref] or with evolutions of that 
framework as developed in the httpbis WG. That is, the evolution of the 
HTTP authentication framework is to be done in the httpbis WG and not in 
the http-auth WG.

However, the http-auth WG may document requirements for changes or 
additions to the HTTP authentication framework and any schemes developed 
in the http-auth WG that would benefit from such changes or additions to 
the HTTP authentication framework must document those changes or 
additions as an inherent part of their specifications. Any such schemes 
must however also be usable with the existing unmodified HTTP 
authentication framework.

The http-auth WG will work closely with the httpbis and tls WGs and the 
<<whatever>> WGs in W3C to ensure that the outcomes from the http-auth 
WG do not conflict with work done elsewhere.

The initial list of work items will be:

- <<the subset of the set of schemes that were proposed to
   the httpbis WG [ref] that survive the BoF>>

Adoption of additional work items will require a re-charter.

The following are out of scope:

- changes to HTTP
- changes to TLS
- definition of authentication mechanisms that do not work with
   the current HTTP authentication framework
- authentication of devices or components of web services (??)
   <<not sure about this bit, we don't want to boil any oceans,
   but maybe "just web sites" is too limiting?>>

Milestones:

- <<entirely dependent on the list of survivors>>

[http-auth] drafty http-auth wg charter Sean Turner
Re: [http-auth] drafty http-auth wg charter Harry Halpin
Re: [http-auth] drafty http-auth wg charter Nico Williams
Re: [http-auth] drafty http-auth wg charter Julian Reschke
Re: [http-auth] drafty http-auth wg charter Stephen Farrell
Re: [http-auth] drafty http-auth wg charter Nico Williams