Subject: [OAUTH-WG] Bikeshedding poll: 'attributes' parameter vs. attributes parameters

From: Eran Hammer-Lahav <[email-masked]>
Date: Thu, 2 Dec 2010 14:04:29 -0700

I'm defining a new token type: MAC based on my previous HTTP Token authentication draft (which in turn was based on 1.0a HMAC-SHA1). This is being drafted and implemented in my current project (in node.js). I will have a draft to share shortly (I do not plan to make this a WG item, but will not object if the group wants to).

When issuing a token, the authorization server needs to provide two additional attributes:

- mac algorithm (hmac-sha1 and hmac-sha256 will be defined)
- secret

I have two options; extend the token response by registering:

1. Type specific parameters: 'mac_algorithm' and 'token_secret'
2. Generic parameter: 'attributes' with some form of key-value pairs

I prefer #1 because it is much simpler. However, #2 is cleaner and better if we end up with a lot of token types.

So I'm going with #1 but open to other suggestions and feedback.

EHL

---

From: Justin Richer <[email-masked]>
Date: Thu, 2 Dec 2010 16:44:44 -0500

#1

#2 feels like overengineering, and we're going to end up with things
that spit back stuff that aren't token attributes anyway that will want
to put them at the top level. 

Also, no need to require a more complex structure. I tried to make it so
that the XML encoding can handle more complex things like lists and
sub-objects, but even so I'd rather keep the basic specification (and
recommendations for extensions) as flat as possible.

 -- Justin

On Thu, 2010-12-02 at 16:04 -0500, Eran Hammer-Lahav wrote:
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Marius Scurtescu <[email-masked]>
Date: Thu, 2 Dec 2010 13:56:04 -0800

> recommendations for extensions) as flat as possible.

Same here, I think #1 makes more sense.

And, I don't think we have to worry about collision across token
types, only one will be use at a time.

Marius

---

From: Igor Faynberg <[email-masked]>
Date: Fri, 03 Dec 2010 16:10:02 -0500

Abstain.  (The reason: I cannot predict how the tokens will evolve.)

Igor