Subject: [Ace] Review of draft-ietf-ace-oauth-authz-00

From: Paul Madsen <[email-masked]>
Date: Mon, 22 Feb 2016 07:59:41 -0500

Hi, I've read throughdraft-ietf-ace-oauth-authz-00 and thought I'd share 
my high-level feedback and some thoughts from conversations we have been 
having with our customers with IoT use cases

- the approach of binding OAuth 2.0 to IoT use cases & protocols is 
critical, as the current default authentication mechanism for many 
devices appears to be passwords or certs burnt in at manufacture time - 
both of which have security & privacy implications

- this sort of binding has been resonating with the customers I talk to, 
as it reuses for IoT use cases the conceptual model of user-mediated 
token issuance they know from their existing REST APIs & native 
application deployments.

- while the consent step that that this model enables is critical for 
consumer IoT deployments (like customers with smart home offerings) it 
remains relevant even in workforce & IoT use cases where consent may be 
less of a concern, but supporting different employees sharing a given 
device over the work day (shop floor etc) is

- importantly, the approach offers to enterprises the promise of being 
able to reuse their existing investments in OAuth (and related specs, 
e.g. OpenID Connect, JWT, JOSE etc). Even if they are not currently 
confronting IoT use cases, work such as this reassures enterprises that 
these standards will evolve as necessary, and that any OAuth servers 
they've bought will evolve in lockstep so that, when they do have to 
support authentication of/to constrained devices, they can be confident 
that their authentication & authorization infrastructure will be prepared

- the customers who are imagining (or supporting) use cases beyond the 
simplest architecture of devices talking to its own cloud (with likely 
proprietary authn mechanisms) see the need for an interoperable identity 
layer by which, for instance, a device might have to interact with 
different devices or cloud endpoints and do so on behalf of different 
users, e.g. a smart home speaker calling streaming music APIs on behalf 
of the various family members in a household.

I believe that the best bet for such an interoperable identity layer for 
IoT is one built on OAuth and related specs, while profiling/extending 
to new constraints & requirements. Work such as 
draft-ietf-ace-oauth-authz-00 is an important early step towards that

Regards

paul

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 25 Feb 2016 20:41:16 +0100

Hi Paul

thanks for looking at the current version of the document. In time for
the virtual interim meeting (=fancy word for a conference call), which
will take place next Wednesday, we will have an updated version ready
that improves readability.

Great also to hear that your interactions with customers have been
positive and that they feel supported in their investments.

We hope that you (and your company) continues to support the work and
the prototyping / interoperability testing efforts we want to schedule
once the specifications becomes stable enough.

Ciao
Hannes

On 02/22/2016 01:59 PM, Paul Madsen wrote:
> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>