Subject: [httpapi] Link relationship types for authentication

From: Gabriel Sullice <[email-masked]>
Date: Mon, 25 Jan 2021 13:44:49 -0500

Hello,

Has this group considered working on this draft: Link relationship types
for authentication
<https://tools.ietf.org/id/draft-pot-authentication-link-01.html>

Link rels for authentication, registration and user identification could be
very useful for any HTTP API that may require authentication. It seems like
a valuable thing to standardize to me.

I see that Evert proposed it last October
<https://mailarchive.ietf.org/arch/msg/httpapi/jRqWyZiLw5_SSiqajOoHtkUe6WE/>,
but his email didn't receive any replies (unfortunately, I joined the list
a few days too late). I think the group was busy with preparing an agenda
for IETF 109 and/or his email may have been overshadowed by another
proposal that had a lot of overlap with the Linkset draft.

Is this something this group would like to work on, now or in the future?

Kindly,

Gabe

---

From: Darrel Miller <[email-masked]>
Date: Tue, 26 Jan 2021 02:52:08 +0000

Hey Gabriel,

From: httpapi <[email-masked]> on behalf of Gabriel Sullice <[email-masked]>
Has this group considered working on this draft: Link relationship types for authentication<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fid%2Fdraft-pot-authentication-link-01.html&data=04%7C01%7CDarrel.Miller%40microsoft.com%7Cba939669953846eaada708d8c16157f2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637471971140493016%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6cwBMzptjrN3tQjkA1rhFtt1mchDg8K30pV2lPCCh5I%3D&reserved=0>

I missed this when Evert originally posted it.  From a quick review they seem like they would be useful additions to the Link Relation Types.   Do you know if Evert posted this to the Link Relations Type mailing list?  https://mailarchive.ietf.org/arch/browse/link-relations/

They would seem like a good place to get feedback.

Darrel

---

From: Roberto Polli <[email-masked]>
Date: Tue, 26 Jan 2021 16:04:39 +0100

Hi,

Il giorno mar 26 gen 2021 alle ore 03:52 Darrel Miller
<Darrel.Miller=[email-masked]> ha scritto:
>Do you know if Evert posted this to the Link Relations Type mailing list?
>  https://mailarchive.ietf.org/arch/browse/link-relations/

Maybe the OAuth workgroup could be interested or working on something
like this, too.
Pax,
R.

---

From: Evert Pot <[email-masked]>
Date: Tue, 26 Jan 2021 15:55:06 -0500

Hi Darrel,

On 2021-01-25 9:52 p.m., Darrel Miller wrote:
> Hey Gabriel,
>
>
>     *From:* httpapi <[email-masked]> on behalf of Gabriel
>     Sullice <[email-masked]>
>     Has this group considered working on this draft: Link relationship
>     types for authentication
>     <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fid%2Fdraft-pot-authentication-link-01.html&data=04%7C01%7CDarrel.Miller%40microsoft.com%7Cba939669953846eaada708d8c16157f2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637471971140493016%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=6cwBMzptjrN3tQjkA1rhFtt1mchDg8K30pV2lPCCh5I%3D&reserved=0>
>
>
> I missed this when Evert originally posted it.  From a quick review 
> they seem like they would be useful additions to the Link Relation 
> Types.   Do you know if Evert posted this to the Link Relations Type 
> mailing list? https://mailarchive.ietf.org/arch/browse/link-relations/ 
> <https://mailarchive.ietf.org/arch/browse/link-relations/>
>

Thanks! I just opened an issue here:
https://github.com/protocol-registries/link-relations/issues/24

Evert

---

From: Evert Pot <[email-masked]>
Date: Tue, 26 Jan 2021 16:05:27 -0500

> Maybe the OAuth workgroup could be interested or working on something

I've sent an email to their list a while back. There was some feedback, 
but nothing really substantial:

https://mailarchive.ietf.org/arch/msg/oauth/SqVD1YBqq-XCUREEVu9YXjKmrto/

So, I'm not sure if there's more to be done there(?).

For what it's worth, in the years since I've published the first draft, 
I've had more than a few people tell me they use (some of) these link 
relationships in their system, usually after it was found with a google 
search.

I think oauth2 adoption would be great. One of it's failings I think is 
the fact that user agents can't discover anymore how to authenticate a 
user after getting a 401, so this is a nice step in the direction of 
potentially solving that.

Evert

---

From: Graham Cox <[email-masked]>
Date: Tue, 26 Jan 2021 21:24:26 +0000

Apologies if this has already been covered, but have you looked into the
overlap between this and OpenID Connect? I'm far from an expert, but it
seems that some - though not all - of the relations defined here correspond
well with the actions that OIDC offer, though obviously they work in
notably different ways. (The *authenticated-as* relation doesn't have any
direct mapping in OIDC that I can think of, but they others all map on to
*something*)

Cheers
-- 
Graham Cox

On Tue, 26 Jan 2021 at 21:05, Evert Pot <[email-masked]> wrote:

> --
> httpapi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/httpapi
>

---

From: Evert Pot <[email-masked]>
Date: Tue, 26 Jan 2021 17:11:57 -0500

On 2021-01-26 4:24 p.m., Graham Cox wrote:
> Apologies if this has already been covered, but have you looked into 
> the overlap between this and OpenID Connect? I'm far from an expert, 
> but it seems that some - though not all - of the relations defined 
> here correspond well with the actions that OIDC offer, though 
> obviously they work in notably different ways. (The /authenticated-as/ 
> relation doesn't have any direct mapping in OIDC that I can think of, 
> but they others all map on to *something*)
I'm somewhat aware of the specifications and general plumbing. The link 
relations I'm hoping to register are extremely general though, and don't 
impose any sort of protocols or media types.

For example, a browser extension might find a a link with rel="logout", 
and render a logout button in a toolbar. It would be good to know if 
this is fundamentally incompatible with protocols like OpenID Connect, 
but I'm also not the person to say anything about this with confidence.

Evert

---

From: Erik Wilde <[email-masked]>
Date: Wed, 27 Jan 2021 09:03:21 +0100

hello.

> impose any sort of protocols or media types.

ideally, that's the case for *all* registered link relation types. it's 
not what happens in practice, but good design would imply that link 
relation types are agnostic of implementation details, and these details 
then are established by using link relation types in a specific context, 
such as a protocol that has certain media types for passing messages around.

> but I'm also not the person to say anything about this with confidence.

if OIDC doesn't have the model of generally applicable link relation 
types, then another possible way forward would be to change that and 
make the OIDC link relation types reusable (and register them), but that 
of course depends on the details of OIDC and how interested that 
community is to create reusable building blocks as part of their spec.

cheers,

dret.

-- 
erik wilde | mailto:[email-masked] |
            | http://dret.net/netdret    |
            | http://twitter.com/dret    |

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 28 Jan 2021 17:23:23 +1100

Just to clarify -- that list can give advice about the details of registration and whether or not the use 'fits' link relations, but the discussion of the proposal should happen in the relevant community -- i.e., here.

Cheers,

> On 26 Jan 2021, at 1:52 pm, Darrel Miller <Darrel.Miller=[email-masked]> wrote:
> 
> Hey Gabriel,
> 
> 
> Has this group considered working on this draft: Link relationship types for authentication
> 
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Darrel Miller <[email-masked]>
Date: Fri, 29 Jan 2021 14:31:49 +0000

Mark,
From: Mark Nottingham <[email-masked]>

Thanks for the clarification, I wasn't sure about that.

Darrel