Subject: Re: [OAUTH-WG] Call for adoption - OAuth Proof of Possession Tokens with HTTP Message Signatures

From: George Fletcher <[email-masked]>
Date: Fri, 27 Aug 2021 15:58:06 -0400

Just curious where this landed? Was it adopted by the WG? I'm ok with 
adopting it. We will just need to be clear about the overlap with DPoP 
and determine if guidance is necessary for when to use which method.

Thanks,
George

On 7/30/21 3:26 PM, Aaron Parecki wrote:
> I support the adoption of this document, it seems like a good starting 
> point for defining the link between HTTP Signatures and OAuth.
>
> Aaron
>
>
> On Mon, Jul 19, 2021 at 7:18 AM Justin Richer <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Needless to say, but as the author of both this draft and the
>     draft that it would replace, I am in favor of adoption of this
>     document. There are still a lot of open questions to answer — such
>     as key introduction and management practices — and I think there
>     is a lot of power in the intersection of the OAuth and HTTPSig
>     spaces.
>
>      — Justin
>
>>     On Jul 16, 2021, at 12:31 PM, Rifaat Shekh-Yusef
>>     <[email-masked] <mailto:[email-masked]>> wrote:
>>
>>     All,
>>
>>     This is a call for adoption for the *OAuth Proof of Possession
>>     Tokens with HTTP Message Signatures* draft as a WG document:
>>     https://datatracker.ietf.org/doc/draft-richer-oauth-httpsig/
>>     <https://datatracker.ietf.org/doc/draft-richer-oauth-httpsig/>
>>
>>     Please, provide your feedback on the mailing list *by July 30th*.
>>
>>     Regards,
>>      Rifaat & Hannes
>>     _______________________________________________
>>     OAuth mailing list
>>     [email-masked] <mailto:[email-masked]>
>>     https://www.ietf.org/mailman/listinfo/oauth
>>     <https://www.ietf.org/mailman/listinfo/oauth>
>
>     _______________________________________________
>     OAuth mailing list
>     [email-masked] <mailto:[email-masked]>
>     https://www.ietf.org/mailman/listinfo/oauth
>     <https://www.ietf.org/mailman/listinfo/oauth>
>
>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Sat, 28 Aug 2021 09:38:45 -0400

George,

No, it was not adopted as we did not get enough people to support it.

Regards,
 Rifaat

On Fri, Aug 27, 2021 at 3:58 PM George Fletcher <gffletch=
[email-masked]> wrote:

> adopting it. We will just need to be clear about the overlap with DPoP and
> determine if guidance is necessary for when to use which method.
>
> Thanks,
> George
>
> On Mon, Jul 19, 2021 at 7:18 AM Justin Richer <[email-masked]> wrote:
>
>> Needless to say, but as the author of both this draft and the draft that
>> it would replace, I am in favor of adoption of this document. There are
>> still a lot of open questions to answer — such as key introduction and
>> management practices — and I think there is a lot of power in the
>> intersection of the OAuth and HTTPSig spaces.
>>
>>  — Justin
>>
>> On Jul 16, 2021, at 12:31 PM, Rifaat Shekh-Yusef <[email-masked]>
>> wrote:
>>
>> All,
>>
>> This is a call for adoption for the *OAuth Proof of Possession Tokens
>> with HTTP Message Signatures* draft as a WG document:
> OAuth mailing [email-masked]://www.ietf.org/mailman/listinfo/oauth
>
>