Re: [OAUTH-WG] draft-fett-oauth-dpop-00

2019-03-30 Thread rich levinson
Speaking for myself, as a long time user of OAuth 2.0, I am very enthusiastic about the new proposal:   "OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer"   https://tools.ietf.org/html/draft-fett-oauth-dpop-00 I believe it represents a real milestone for OAuth in that it ap

[OAUTH-WG] Genart last call review of draft-ietf-oauth-jwt-bcp-04

2019-03-30 Thread Brian Carpenter via Datatracker
Reviewer: Brian Carpenter Review result: Ready with Issues Gen-ART Last Call review of draft-ietf-oauth-jwt-bcp-04 I am the assigned Gen-ART reviewer for this draft. The General Area Review Team (Gen-ART) reviews all IETF documents being processed by the IESG for the IETF Chair. Please treat the

Re: [OAUTH-WG] draft-bertocci-oauth-access-token-jwt-00

2019-03-30 Thread Vittorio Bertocci
Hey Benjamin, Of course I agree that sheer headcount isn’t the main factor :). The main point here is that this is a profile meant to promote and facilitate interoperability, so _as long as a proposal is is sound & secure_, the number of products and services favoring it does have direct impact on

Re: [OAUTH-WG] draft-bertocci-oauth-access-token-jwt-00

2019-03-30 Thread Benjamin Kaduk
Hi Vittorio, On Tue, Mar 26, 2019 at 09:48:08AM -0700, Vittorio Bertocci wrote: > thank you Steinar and everyone else for the comments on this! > To summarize the situation so far: Dominick, Steinar, Rob, David, Nov, > Bertrand recommend using sub only for users. Martin would like to have the > su