Subject: [http-auth] BoF in Atlanta

From: Yoav Nir <[email-masked]>
Date: Fri, 5 Oct 2012 18:23:55 +0200

Hi all

The preliminary agenda is now posted at https://datatracker.ietf.org/meeting/85/agenda.txt , as well as at http://tools.ietf.org/agenda/85/

Either way, we are currently scheduled to meet at 13:00 on Wednesday, 7-Nov, in Grand Ballroom D. We have 1.5 hours to go. Note that we cannot guarantee that the scheduling will not change, but it is not likely to, and we'll do our best to keep it on Wednesday.

We propose the following agenda:
- 13:00-13:05 Blue sheets, Note Well and agenda bashing
- 13:05-13:20 Introduction and problem statement
- 13:20-14:00 (Short!!!) presentations on the candidates
- 14:00-14:30 Charter hack, and the usual BoF questions

People with candidate documents, who wish to present at the session should do the following:
- Notify the chairs sooner rather than later
- Prepare a short presentation. 
  * You will only have a few minutes each and want to leave time for Q&A, so plan on no more than 5 minutes of presso.
  * You don't each need to explain the problem. We'll do it in the introduction.
  * You don't each need to explain what is the "HTTP authentication framework".
- Send slides to the chairs (PDF or PPT format) early - no later than Monday the 5th.
- If you would like to present, but will not be at the meeting, please contact us early so that we can arrange remote presentation or presentation by proxy.

See you all there

Derek & Yoav

---

From: Lucy Lynch <[email-masked]>
Date: Fri, 12 Oct 2012 11:07:11 -0700 (PDT)

> People with candidate documents, who wish to present at the session 

just as an aide mémoire the following documents have been mentioned
on the BOF thread:

- draft-oiwa-*
- draft-farrell-httpbis-hoba
- draft-melnikov-httpbis-scram-auth
- draft-williams-httpbis-auth-classification
- draft-ahrens-httpbis-digest-auth-update (sean)

- Note: Actually, please include draft-williams-http-rest-auth
(RESTauth, successor to REST-GSS) and remove
draft-williams-httpbis-auth-classification. (nico)

- What about Negotiate? Its already an informational RFC but I have
a hunch that work has been done on it since it was published.
Somebody should ask (nudge-nudge) MSFT... (leif)

- http://www.w3.org/2012/webcrypto/WebCryptoAPI/ (harry)

- There is a proposal in HTML5 for enhancing form support of HTTP which
includes 'mapping' username\passwords into the same XHR.open()
functionality. Also included is a method for clearing the auth cache
on successful response which integrates with a HTTP request for server
notification and cookie clearing:
http://www.w3.org/wiki/User:Cjones/ISSUE-195 (cameron)

Also -

- active discussion on I18n but no documents listed

- Lucy

> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>

---

From: Gabriel Montenegro <[email-masked]>
Date: Fri, 12 Oct 2012 23:08:54 +0000

Hi Lucy,

> just as an aide mémoire the following documents have been mentioned on
> the BOF thread:

Your list was not complete. This list has them all:
http://trac.tools.ietf.org/wg/httpbis/trac/wiki/HttpAuthProposals

> - What about Negotiate? Its already an informational RFC but I have a hunch
> that work has been done on it since it was published.

http://msdn.microsoft.com/en-us/library/dd303576(prot.20).aspx 

Some of it (Persistent-Auth header) we repeated in our multilegged auth draft available from the list above.

Thanks,

Gabriel

---

From: Julian Reschke <[email-masked]>
Date: Sat, 13 Oct 2012 12:49:38 +0200

On 2012-10-12 20:07, Lucy Lynch wrote:
>> The preliminary agenda is now posted at
>> https://datatracker.ietf.org/meeting/85/agenda.txt , as well as at
>> http://tools.ietf.org/agenda/85/
>>
>> Either way, we are currently scheduled to meet at 13:00 on Wednesday,
>> 7-Nov, in Grand Ballroom D. We have 1.5 hours to go. Note that we
>> cannot guarantee that the scheduling will not change, but it is not
>> likely to, and we'll do our best to keep it on Wednesday.
>>
> ...

http://greenbytes.de/tech/webdav/draft-reschke-basicauth-enc-06.html

Best regards, Julian

---

From: Leif Johansson <[email-masked]>
Date: Sun, 14 Oct 2012 12:06:41 +0200

On 10/13/2012 01:08 AM, Gabriel Montenegro wrote:
> Hi Lucy,
> 
> 
>> just as an aide mémoire the following documents have been
>> mentioned on the BOF thread:
> 
>> - What about Negotiate? Its already an informational RFC but I
>> have a hunch that work has been done on it since it was
>> published. Somebody should ask (nudge-nudge) MSFT... (leif)
> 
> Some of it (Persistent-Auth header) we repeated in our multilegged
> auth draft available from the list above.
> 

Still, that isn't listed on the wiki-page. Also absent is my HTTP GSS
proposal (expired)

http://datatracker.ietf.org/doc/draft-johansson-http-gss/

	Cheers Leif

---

From: Gabriel Montenegro <[email-masked]>
Date: Sun, 14 Oct 2012 21:11:23 +0000

> >> - What about Negotiate? Its already an informational RFC but I have a
> >> hunch that work has been done on it since it was published. Somebody
> >> should ask (nudge-nudge) MSFT... (leif)
> >
> Still, that isn't listed on the wiki-page. Also absent is my HTTP GSS proposal
> (expired)

The multilegged draft *is* listed on the wiki page where it says:

Multilegged Authentication for HTTP Multiplexing 
The url: http://tools.ietf.org/html/draft-montenegro-httpbis-multilegged-auth/

---

From: Leif Johansson <[email-masked]>
Date: Sun, 14 Oct 2012 23:23:58 +0200

On 10/14/2012 11:11 PM, Gabriel Montenegro wrote:
> 
>>>> - What about Negotiate? Its already an informational RFC but
>>>> I have a hunch that work has been done on it since it was
>>> Some of it (Persistent-Auth header) we repeated in our
>>> multilegged auth draft available from the list above.
>>> 
>> 
>> Still, that isn't listed on the wiki-page. Also absent is my HTTP
>> GSS proposal (expired)
> 
> Multilegged Authentication for HTTP Multiplexing The url:
> http://tools.ietf.org/html/draft-montenegro-httpbis-multilegged-auth/
>
> 
> 

I wasn't talking about http-multilegged.

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 14 Oct 2012 22:25:27 +0100

Yoav,

Speaking solely as a proponent of one of the
proposals, and not as an AD...

My hope is that if we do form a wg that it'll not
be with a goal of picking winners amongst the
various proposals, but rather of getting those of
'em that are sensible, have enough author-energy
etc. to become experimental RFCs (or better I
suppose in the case of wild success). And those
can then all individually prosper or wither as
determined by adoption or lack thereof.

Does that match others' expectations for Atlanta?

Cheers,
S.

PS: Since I am a proponent of one proposal, I've
made it clear to Sean and the BoF chairs that I'll
not be AD-like at all where this BoF is concerned.

---

From: Yoav Nir <[email-masked]>
Date: Mon, 15 Oct 2012 00:05:50 +0200

> Does that match others' expectations for Atlanta?

Hi Stephen.

It matches the instructions we got from Sean, and it matches my expectations personally.

The plan is to have short presentations on the 5 proposals (or "candidates"). We have received confirmations from 3 groups (including yours) and should soon know definitely about the other two. Then we plan to discuss the charter:

First, I'd like to make sure that enough people believe that pursuing authentication methods in the HTTP layer is worthwhile (as opposed to other layers) and are willing to work in that space. I think this is an important question to ask, because "Basic" and "Digest" have been available for many years, and they were unused in favor of application-layer methods that were no more secure than "Basic". 

Assuming we have a large enough group that is willing to do work in general in this area, the second step is to go over the proposed charter - see that people are OK with a bunch of experimental drafts, where we don't intend to pick the one and only ultimate authentication mechanism for HTTP.

Once that is out of the way, we'll go over the 5 candidates, and ask the regular questions (does anyone object to the wg adding this to the charter? Who is willing to edit? contribute? review?)

To consider this a success, I think we should come out of the BOF with at least three drafts for the working group, and 5 would be OK as well.

I also think such a working group should develop an informational document about UI considerations for HTTP authentication, but we'll leave it out for now, because I don't think there will be time to discuss such a document.

Yoav

---

From: Sean Turner <[email-masked]>
Date: Thu, 18 Oct 2012 08:37:27 -0400

> To consider this a success, I think we should come out of the BOF with at least three drafts for the working group, and 5 would be OK as well.

I tend to think 3 here would be good as well.

spt