Subject: [Ace] Meeting Minutes

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 01 Apr 2015 09:48:48 +0200

Here are some short notes from the ACE meeting:

---------------------

ACE WG Meeting
IETF 92 - Dallas
Tuesday 24 March 2015, 13:00 - 15:00 CDT
Chairs: Kepeng Li, Hannes Tschofenig

* Use Cases (Sandeep S. Kumar)
- No open issues. Next step is to initiate WGLC. Five people volunteered
to review the draft (Carsten, Dominique, Raj, Steve, Nguyen)

* Problem Description (Goeran Selander)
- The term "Configuration Server" needs to be checked.
- There was consensus to use problem description and terminology as a
starting point to work on.

* Actors (Carsten Bormann, 20 mins)
- There was preference to reuse OAuth terminologies (e.g. Resource
Server, Authorization Server).
- Action: Design team is requested to merge Problem Description draft
and Actors draft, and provide a combined draft.

* Delegated CoAP Authentication and Authorization Framework (Carsten
Bormann)
- No time for the detailed discussion. It is recommended to provide
feedback in the mailing list.

* Object Security (Goeran Selander)
- There was comment that part of the work should be done in CORE.
- There was comment that it depends on COSE work.
- No consensus to adopt it this time. More time is needed.

* Use OAuth and UMA (Hannes Tschofenig)
- No time for the detailed discussion. It is recommended to provide
feedback in the mailing list.

* Wrap-up
- Chairs will request 2.5 hours for the next F2F meeting.

---------------------

We asked for a minute taker during the meeting but forgot who it was.
If you took notes please step forward.

Ciao
Hannes

---

From: Michael Richardson <[email-masked]>
Date: Wed, 01 Apr 2015 11:04:27 -0400

> * Problem Description (Goeran Selander) - The term "Configuration
    > Server" needs to be checked.  - There was consensus to use problem
    > description and terminology as a starting point to work on.

    > * Actors (Carsten Bormann, 20 mins) - There was preference to reuse
    > OAuth terminologies (e.g. Resource Server, Authorization Server).  -
    > Action: Design team is requested to merge Problem Description draft and
    > Actors draft, and provide a combined draft.

I wonder if a virtual interim might help advance this, and reduce the time
needs at the next meeting?

    > * Wrap-up - Chairs will request 2.5 hours for the next F2F meeting.

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 01 Apr 2015 19:06:50 +0200

That's a good idea, Michael.

It would also set a hard deadline for folks to agree on the text.

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 01 Apr 2015 20:02:33 +0200

> It would also set a hard deadline for folks to agree on the text.

Good idea.

I certainly don't want to spend the summer polishing this text.
(If you ask me, it's done; I'm waiting for input from the WG what to fix.)

Grüße, Carsten

---

From: Göran Selander <[email-masked]>
Date: Wed, 1 Apr 2015 21:34:51 +0000

>> It would also set a hard deadline for folks to agree on the text.

I agree to a hard deadline.

We have all had some things to attend to after returning from Dallas and
some of us are on Easter holidays but two inputs have already been shared
in the design team and the work will continue tomorrow.

The instructions from the WG are clear and anyone is invited to follow the
progress of the work, but we save the details for those who are really
keen.

Best regards,
Göran

---

From: Stefanie Gerdes <[email-masked]>
Date: Thu, 02 Apr 2015 09:47:04 +0200

Hi all,

> (If you ask me, it's done; I'm waiting for input from the WG what to fix.)

I would really like to know what other WG participants think about this. 
I wrote the original actors draft to provide for an architecture model 
that is able to cover all aspects of the problem we are trying to solve, 
and enables us to talk about these problems. Until now no one was able 
to tell me what was missing in the original draft.

I'm still wondering if it wouldn't have been easier to make the original 
actors draft a working group document when people asked for that and 
include what is missing afterwards (if there really was anything to 
change other than the terminology). I get that people want a compromise 
but the original actors draft already was that compromise.

Best regards,
Steffi

---

From: Göran Selander <[email-masked]>
Date: Thu, 2 Apr 2015 09:12:18 +0000

Hi all,

I did not want to reopen this discussion, but I want to point out that
Ludwig and I wrote the original problem description draft to provide an
architecture model that is able to cover all aspects of the problem we are
trying to solve, and enables us to talk about these problems. The updated
version reflected the input we got for the informal interrim ACE meeting,
so it is already a compromise.

I have provided a number of comments on the actors draft, including
missing end-to-end security, overall problem statement, etc. I have not
received any further comments on the problem description draft.

I hear that people want a compromise, I don’t see that adoption of one
draft will improve the situation - on the contrary - this will just become
a repetition of the discussion of the use case document after its adoption.

My recommendation for the WG is to set a deadline for the design team and
encourage the team to come up with a common structure and text.

That will also create a grace period on the ACE list for more fruitful
discussions.

Best regards,
Göran

On 2015-04-02 09:47, "Stefanie Gerdes" <[email-masked]> wrote:

>_______________________________________________
>Ace mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ace

---

From: Stefanie Gerdes <[email-masked]>
Date: Thu, 02 Apr 2015 11:19:02 +0200

Hi Göran,

I don't want to reopen the discussion, either. But I really would like 
to know what other people want and think. Since there were no comments 
on the problem description draft as you said and several people said 
that they liked the actors draft and even proposed it to be working 
group draft, it would be good to know what other people missed in the 
actors draft.

Best regards,
Steffi

-- 
Stefanie Gerdes			Tel: +49 421 218 63906
TZI Universität Bremen		E-Mail: [email-masked]
Bibliothekstr. 1, MZH 5150
28359 Bremen, Germany

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 02 Apr 2015 11:27:52 +0200

Based on the discussion during the meeting Kepeng and I got the
impression that the group wants to see a harmonized proposal from the
key participants involved in that discussion (rather than having
different ideas floating around).

First, the members of that small design team (consisting of Carsten,
Steffi, Goeran, and Ludwig*) need to come up with something they can
agree with among each other. Then, come back to the group and present
it. Deadline: May.

Ciao
Hannes

PS: If someone else wants to part of the design team please let Kepeng
and myself know.

---

From: Stefanie Gerdes <[email-masked]>
Date: Thu, 02 Apr 2015 11:44:15 +0200

Hi Hannes,

it would still be helpful to know what other people on the list other 
than the authors of the documents want and need. I just want to 
encourage people to provide input on that. It's easier to come up with a 
useful design if we understand what other people are thinking.

Best regards,
Steffi

---

From: Michael Richardson <[email-masked]>
Date: Mon, 06 Apr 2015 10:23:48 -0400

Stefanie Gerdes <[email-masked]> wrote:
    >> I certainly don't want to spend the summer polishing this text.  (If
    >> you ask me, it's done; I'm waiting for input from the WG what to fix.)

    > I would really like to know what other WG participants think about
    > this. I wrote the original actors draft to provide for an architecture
    > model that is able to cover all aspects of the problem we are trying to
    > solve, and enables us to talk about these problems. Until now no one
    > was able to tell me what was missing in the original draft.

Because I felt that the original actors document was just fine, and I
advocated for adopting it multiple meetings ago, I am happy if we finally
have a way forward.

Just so that I am clear: what is your understanding of what is missing?
Please feel free to point to an email that perhaps I did not read well
enough.

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 09 Apr 2015 19:45:47 +0200

Hi Michael,

I don't remember if you have been at the ACE WG meeting at IETF#92 but
the participants in the room gave us the feedback that they liked the
approach Goeran presented. Then, it turns out that they also liked the
content Carsten proposed.

In the subsequent discussion someone suggested to let the two groups
work as part of a design team.

Kepeng and I liked the idea and that's what we then decided to do.

Ciao
Hannes

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 09 Apr 2015 19:48:30 +0200

> Kepeng and I liked the idea and that's what we then decided to do.

Exactly, and we're at it: we had our first phone call today and will
have another one on Monday.

Grüße, Carsten

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 09 Apr 2015 19:48:24 +0200

Hi Steffi,

of course it would be great to know what other thinks as well.

The feedback we got during the meeting was that folks want some
terminology and there is a preference for re-using OAuth terminology
(since this is something they already know).

The problem statement should also be pretty simple to explain.

In earlier versions we had the terminology in the use case document
already (and then someone removed it).

Normally, it does not need a 30+ page document to explain these types of
things.

Ciao
Hannes

On 04/02/2015 11:44 AM, Stefanie Gerdes wrote:
>>>> this.