Subject: [http-auth] FW: New Version Notification for draft-woodworth-json-http-auth-00.txt

From: "Woodworth, John R" <[email-masked]>
Date: Fri, 3 Mar 2017 09:16:36 +0000

All,

I understand this is late to the party but was hoping some of you may have time to review our new draft.  We welcome any questions, comments and assistance from the group.

Thanks,
John
-----Original Message-----
From: [email-masked] [mailto:[email-masked]]

A new version of I-D, draft-woodworth-json-http-auth-00.txt
has been successfully submitted by John Woodworth and posted to the IETF repository.

Name:           draft-woodworth-json-http-auth
Revision:       00
Title:          HTTP Authentication - |JSON| Scheme
Document date:  2017-02-28
Group:          Individual Submission
Pages:          17
URL:            https://www.ietf.org/internet-drafts/draft-woodworth-json-http-auth-00.txt
Status:         https://datatracker.ietf.org/doc/draft-woodworth-json-http-auth/
Htmlized:       https://tools.ietf.org/html/draft-woodworth-json-http-auth-00

Abstract:
   The |JSON| authentication scheme provides a mechanism for exchanging
   authentication challenges and credentials as objects in the form of
   JavaScript Object Notation (JSON).  This scheme offers a secure
   mechanism of providing authenticated access to a set of protected
   HTTP resources which may be handled by scripting utility framework as
   in XMLHttpRequest calls (AJAX) or directly by the client's user
   agent.  This chaining feature is unique to this scheme.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

-- THESE ARE THE DROIDS TO WHOM I REFER:
This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

---

From: Julian Reschke <[email-masked]>
Date: Sun, 5 Mar 2017 12:02:58 +0100

On 2017-03-03 10:16, Woodworth, John R wrote:
> ...

Hi there,

a few formal nits:

- please don't put "httpauth" on the front page if the draft isn't a 
Working Group draft - that said, *do* add a note to the front page with 
instructions where to send feedback (this list is fine for that)

- you IPR statement looks weird:

> This document may contain material from IETF Documents or IETF
> Contributions published or made publicly available before November
> 10, 2008.

- registering a whole set of auth schemes isn't going to fly; please 
also consider removing the somewhat weird pipe characters from the 
scheme name...

Best regards, Julian

---

From: "Woodworth, John R" <[email-masked]>
Date: Sun, 5 Mar 2017 21:10:42 +0000

> From: Julian Reschke [mailto:[email-masked]]
>
> > I understand this is late to the party but was hoping some of you
> > may have time to review our new draft.  We welcome any questions,
> > comments and assistance from the group.
> > ...
>
> Hi there,
>
>
> a few formal nits:
>
> - please don't put "httpauth" on the front page if the draft isn't
> a Working Group draft - that said, *do* add a note to the front page
> with instructions where to send feedback (this list is fine for that)
>

Hi Julian,

First, thank you for looking at our draft and your comments, we are
very excited to have feedback so quickly.

We understand listing the intended WG is premature and it will be
removed as suggested.

> > Contributions published or made publicly available before November 10,
> > 2008.

Again, thank you.

This is an oversight and was mistakenly left in from another draft we
are working on.  It will be removed in our next release.

> also consider removing the somewhat weird pipe characters from
> the scheme name...
>

This draft is currently experimental but intended to be somewhat of
an umbrella for a "class" of schemes.  We understand this may be
different than currently available schemes but it is something which
makes ours different.  Any advice you have for registering a scheme
"class" would be appreciated.

The pipe is rather critical to the draft as it is used as an
"indicator" for intent.  As I understand it, it is a legal character
and was chosen for another project we are working on as others were
unavailable to the scheme name.  We are rather happy with the way
it is currently working in our implementation and felt it would be
a good idea to share our solution with an even larger community.

It (the pipe) is used to indicate our scheme "class" and allow for
scripts in the browser to offer authentication ahead of the built-in
logic offered by the browser.  For example, if one tries to implement
the "Basic" scheme in a script providing a pretty themed page, it
will undoubtedly be rudely intercepted by the browser via an ugly
login popup without any scripting or theming capabilities.  Our
draft hopes to offer an alternate path.

We debated taking it (the pipe) out of some of the titles and
references but the protocol chaining feature we are introducing
relies on it in order to properly function.

Thanks again,
John

---

From: Julian Reschke <[email-masked]>
Date: Mon, 6 Mar 2017 07:56:09 +0100

> We understand listing the intended WG is premature and it will be

FWIW, there is no httpauth WG anymore. So a new or different WG would be 
needed.

> "class" would be appreciated.

There is currently no way to register a class of schemes, it's somewhat 
contrary to the concept of the registry. I would recommend to find a way 
where no registration of classes is needed.

Best regards, Julian

---

From: "Woodworth, John R" <[email-masked]>
Date: Mon, 6 Mar 2017 15:47:30 +0000

Hi Julian,

>
> FWIW, there is no httpauth WG anymore. So a new or different WG
> would be needed.
>

Understood.

> > ...
>
> There is currently no way to register a class of schemes, it's
> somewhat contrary to the concept of the registry. I would recommend
> to find a way where no registration of classes is needed.
>

We do love a challenge :)

Thanks again,
John