[OAUTH-WG] draft-ietf-oauth-assertions WGLC comment
Brian Campbell <bcampbell@pingidentity.com> Mon, 23 April 2012 12:42 UTC
Return-Path: <bcampbell@pingidentity.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D8A021F861E for <oauth@ietfa.amsl.com>; Mon, 23 Apr 2012 05:42:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.958
X-Spam-Level:
X-Spam-Status: No, score=-5.958 tagged_above=-999 required=5 tests=[AWL=0.018, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3J-d-QpRLeDT for <oauth@ietfa.amsl.com>; Mon, 23 Apr 2012 05:42:10 -0700 (PDT)
Received: from na3sys009aog121.obsmtp.com (na3sys009aog121.obsmtp.com [74.125.149.145]) by ietfa.amsl.com (Postfix) with ESMTP id 59CAD21F8611 for <oauth@ietf.org>; Mon, 23 Apr 2012 05:42:10 -0700 (PDT)
Received: from mail-vx0-f177.google.com ([209.85.220.177]) (using TLSv1) by na3sys009aob121.postini.com ([74.125.148.12]) with SMTP ID DSNKT5VOIZvCmKOunPi4ty9speXEEOUZagdT@postini.com; Mon, 23 Apr 2012 05:42:10 PDT
Received: by vcbf13 with SMTP id f13so11075236vcb.8 for <oauth@ietf.org>; Mon, 23 Apr 2012 05:42:09 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:from:date:message-id:subject:to:content-type :x-gm-message-state; bh=zoHc0mjXUYo2fBpxg9F7e7DBcSsZSvsm+LOAELvBoeE=; b=UOIcnlSA85JDGJIhnW+GVhwbA8JaFeluamOS4Blgk2YcvXUCeox4jZO8Z6Qu1MXAQU DnNzX04nd0Fff6gd71oTpnhLtWFwzpYoMfdP3su+bytOT/wTqXIs5kjrAh3G83ncTgb6 TcuA7RRonz3IqBkp3kwiYyq+UU5ISLtbj9d7PpMKppcoHPuOdqLtB/jdju5YIYOx5Mww v2pS4TnjgxZLiWrzGQW81NAq8O2Rn6nodnnuWMUkWgT8S7DTvknN7L79xatoVfTnd18h PVY0SgTURIlMlszBvq3dsqske9AMeb6BP8WeOZQy3SN08U7EtzKJQlOYkKrevUUoNis2 O0sw==
Received: by 10.220.117.203 with SMTP id s11mr15531931vcq.33.1335184929076; Mon, 23 Apr 2012 05:42:09 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.52.38.104 with HTTP; Mon, 23 Apr 2012 05:41:38 -0700 (PDT)
From: Brian Campbell <bcampbell@pingidentity.com>
Date: Mon, 23 Apr 2012 06:41:38 -0600
Message-ID: <CA+k3eCR07MYOz=R8Y-m_bfkAHBWh+sdrCjSn9nQTFTEeCQ=Xwg@mail.gmail.com>
To: oauth <oauth@ietf.org>
Content-Type: multipart/alternative; boundary="485b39618d1268370504be57f7c3"
X-Gm-Message-State: ALoCoQkek8bi+IIFxIzAfL85Y01aUa8p73212U449xTuR8kxP8luKZx1yHYEuweC5ApI/uELcqAU
Subject: [OAUTH-WG] draft-ietf-oauth-assertions WGLC comment
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 23 Apr 2012 12:42:11 -0000
§6.1 on Client authentication* has the following requirement, "The Principal MUST identify an authorized accessor. If the assertion is self-issued, the Principal SHOULD be the client_id." which doesn't really make sense for client authentication. The self-issuedness of the assertion should have no bearing on the principal (rather the issuer) and, when used for client authentication, the principal should always represent the client. I believe the bullet should instead say, "The Principal SHOULD be the client_id." * http://tools.ietf.org/html/draft-ietf-oauth-assertions-01#section-6.1
- [OAUTH-WG] draft-ietf-oauth-assertions WGLC comme… Brian Campbell