Subject: [Ace] Working Group Adoption Call for draft-bormann-core-ace-aif

From: Jim Schaad <[email-masked]>
Date: Wed, 15 Jul 2020 13:51:39 -0700

I had been holding off doing an adoption call waiting for a formal request
to adopt it.  However, given that this is now a dependency for three
different WG documents I think we need to do this now.

Adoption call for
https://datatracker.ietf.org/doc/draft-bormann-core-ace-aif/ 

This document provides a template for an authorization information format
(AIF) using a CDDL generic.  Questions to be answered:

1.  Do you think the ACE WG should adopt this document?  If not please
provide some reasoning.

2.  If adopted are you willing to review the document?

3.  Would you have any implementation plans?  Currently this is referenced
by the MQTT-TLS document, the Group KDC documents.

Adoption call ends on July 28.

Jim & Daniel

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 16 Jul 2020 08:25:02 +0200

On 2020-07-15, at 22:51, Jim Schaad <[email-masked]> wrote:
> to adopt it.  

Sorry about that — I was still thinking we should finish the discussion about the new dynamic permissions.  But I realize now that these have been around for a month and that they really are not that relevant for the adoption questions.

> However, given that this is now a dependency for three

Great.  Since I didn’t ask to initiate the call, I can reply to it!

It seems this draft is becoming a useful little shared component for other work, so we indeed should adopt it.

(And while everyone else is rereading -09 to see whether we should adopt it — do you have any opinion on the new dynamic permissions?)

Grüße, Carsten

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 17 Jul 2020 15:21:30 -0700

> 1.  Do you think the ACE WG should adopt this document?  If not please

Refreshing my memory of the WG charter, it seems like this can be in scope,
but we should be sure to consider what analogues already exist in
non-constrained systems, and whether we are in fact creating something
generally new and broadly useful.

-Ben

---

From: Carsten Bormann <[email-masked]>
Date: Sat, 18 Jul 2020 01:07:44 +0200

> generally new and broadly useful.

Good point.

The simplistic model of AIF caters to servers where authorization can be described in terms of static resources (now also resources created from static resources) and CoAP methods that can be performed on them.

CoAP methods can be related to HTTP methods.

But I would expect most big-Web applications to have a more sophisticated authorization model, e.g., based on server-side information (user information in a database etc.).
E.g., an OAuth AS in the big Web wouldn’t say “give C access to these 10537 photos” and list them all, but “give C access to Peter’s photos”.

So I think the design of AIF is a bit specialized to devices where resources mostly correspond to physical traits of those devices that don’t go away or come anew, with action resources (which are now handled with dynamic permissions) maybe an exception.

Grüße, Carsten

---

From: Francesca Palombini <[email-masked]>
Date: Tue, 28 Jul 2020 10:50:26 +0000

Hi,

I support adoption of this document, and believe Ace should adopt it. I am willing to review, but I don't have any implementation plans.

Thanks,
Francesca

On 15/07/2020, 22:52, "Ace on behalf of Jim Schaad" <[email-masked] on behalf of [email-masked]> wrote:

    Adoption call for

    Jim & Daniel

    _______________________________________________
    Ace mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/ace

---

From: Marco Tiloca <[email-masked]>
Date: Tue, 28 Jul 2020 15:25:16 +0200

Hi all,

I support adoption of this document and I am willing to review it.

The approach in ace-key-groupcomm-oscore for joining OSCORE groups is
now using an AIF specific data model, also included in our ACE
implementation for Californium.

I plan to extend the implementation to support the Extended
REST-specific model.

Best,
/Marco

-- 
Marco Tiloca
Ph.D., Senior Researcher

RISE Research Institutes of Sweden
Division ICT
Isafjordsgatan 22 / Kistagången 16
SE-164 40 Kista (Sweden)

Phone: +46 (0)70 60 46 501
https://www.ri.se

---

From: Cigdem Sengul <[email-masked]>
Date: Tue, 28 Jul 2020 14:30:46 +0100

Hello,

I support the adoption as well. As Jim said, the MQTT-TLS profile has
adopted the AIF-MQTT for the scope.

Thanks,
--Cigdem

---

From: Daniel Migault <[email-masked]>
Date: Wed, 29 Jul 2020 15:10:39 -0400

Hi,

This email closes the call for adoption. The document as been adopted as WG
document. Please upload the document as an ietf wg document.

Yours,
Daniel

-- 
Daniel Migault
Ericsson