Subject: [Ace] ACE Report

From: "Kepeng Li" <[email-masked]>
Date: Wed, 25 Mar 2015 07:31:33 +0800

ACE WG Meeting
IETF 92 - Dallas
Tuesday 24 March 2015, 13:00 - 15:00 CDT
Chairs: Kepeng Li, Hannes Tschofenig

* Use Cases (Sandeep S. Kumar)
 - No open issues. Next step is to initiate WGLC. Five people volunteered to review the draft.

* Problem Description (Goeran Selander)- The term "Configuration Server" needs to be checked. 
- There was consensus to use problem description and terminology as a starting point to work on.

* Actors (Carsten Bormann, 20 mins)
 - There was preference to reuse OAuth terminologies (e.g. Resource Server, Authorization Server).- Action: Design team is requested to merge Problem Description draft and Actors draft, and provide a combined draft.

* Delegated CoAP Authentication and Authorization Framework (Carsten Bormann)
 - No time for the detailed discussion. It is recommended to provide feedback in the mailing list.

* Object Security (Goeran Selander)
 - There was comment that part of the work should be done in CORE.- There was comment that it depends on COSE work.- No consensus to adopt it this time. More time is needed.
* Use Oauth and UMA (Hannes Tschofenig)
 - No time for the detailed discussion. It is recommended to provide feedback in the mailing list.

* Wrap-up- Chairs will request 2.5 hours for the next F2F meeting.Thanks,Kind RegardsKepeng

---

From: Olaf Bergmann <[email-masked]>
Date: Wed, 25 Mar 2015 01:19:23 +0100

> Chairs: Kepeng Li, Hannes Tschofenig

[...]

> - Action: Design team is requested to merge Problem Description draft
> and Actors draft, and provide a combined draft.

After thinking a while about this I doubt that this is a good idea.
Both documents have a completely different focus:
draft-seitz-ace-problem-description lists a few design considerations
and makes assumptions to lay the ground for a preferred solution, while
draft-gerdes-ace-actors analyzes the entire problem space on a
theoretical level and derives a reference model that takes *all* aspects
of authorization into account. I recommend aligning the documents with
respect to their terminology and otherwise let them stay separate.
I would love to see progress on the solution side soon instead of more
exhausting discussions whether or not the existence of real world
problems shall be denied by the ACE WG.

Grüße
Olaf

---

From: Ludwig Seitz <[email-masked]>
Date: Wed, 25 Mar 2015 09:00:29 +0100

> respect to their terminology and otherwise let them stay separate.

It is quite natural to have a bias for one's own proposal, but claiming 
that the actors draft is more solution neutral than the problem 
description draft is hardly an objective stance.

For the sake of making progress in ACE I'd suggest we do not go into a 
discussion about this and instead try to capture the good points from 
both drafts into one combined document.

> problems shall be denied by the ACE WG.
Now that was hardly a very constructive contribution Olaf. If we are to 
make progress in ACE I suggest you refrain from snarky comments about a 
discussion we discontinued without coming to an agreement.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: Olaf Bergmann <[email-masked]>
Date: Wed, 25 Mar 2015 09:17:18 +0100

Ludwig Seitz <[email-masked]> writes:

> It is quite natural to have a bias for one's own proposal, but
> claiming that the actors draft is more solution neutral than the
> problem description draft is hardly an objective stance.

The actors draft is not my proposal. But I have reviewed it and provided
some feedback to the author. I am indeed bias in the sense that I see
that every solution proposal on the table is covered by the actors
draft, including dcaf, while draft-seitz-ace-problem-description
explicitly removes certain tasks from the problem space. Again: It is ok
for me if a solution is designed skip these tasks (in dcaf, e.g. the
client/CS/Rqp side is free not to make use of these features, being
rewarded with less code and memory complexity) , but the abstract model
should document them.

> Now that was hardly a very constructive contribution Olaf. If we are
> to make progress in ACE I suggest you refrain from snarky comments
> about a discussion we discontinued without coming to an agreement.

Please accept my apologies for that.

Grüße
Olaf

---

From: Robert Cragie <[email-masked]>
Date: Wed, 25 Mar 2015 11:42:37 +0000

I disagree. Cherry picking a few design considerations on its own is not
going to result in a best-for fit solution. Exhaustively analysing the
entire problem space isn't either as it throws out too many options.
However, this bottom up/top down approach used together in an intelligent
manner may do and is likely to converge quicker than the zig-zag path it
has been taking up to now. It is clear that there are already a
considerable number of common areas as was clearly demonstrated in the
presentations yesterday. There seems to be agreement not to get into an
academic debate over the terms and I think there are only 2 or 3 terms (out
of a total of probably less than 10) which differ.

Robert

On 25 March 2015 at 00:19, Olaf Bergmann <[email-masked]> wrote:

> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace
>

---

From: Stefanie Gerdes <[email-masked]>
Date: Wed, 25 Mar 2015 20:45:15 +0100

Hi Robert,

I agree that there are already a considerable number of common areas. 
The actors draft already covers the architecture proposed in the problem 
description. Moreover, the problem description uses the actors draft as 
input, so this is not really surprising.

Can you elaborate what you are missing in the actors draft? That would 
be helpful for me.

Best regards,
Steffi

-- 
Stefanie Gerdes			Tel: +49 421 218 63906
TZI Universität Bremen		E-Mail: [email-masked]
Bibliothekstr. 1, MZH 5150
28359 Bremen, Germany