Subject: [OAUTH-WG] Alexey Melnikov's Discuss on draft-ietf-oauth-discovery-08: (with DISCUSS and COMMENT)

From: Alexey Melnikov <[email-masked]>
Date: Wed, 24 Jan 2018 00:05:52 -0800

Alexey Melnikov has entered the following ballot position for
draft-ietf-oauth-discovery-08: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-oauth-discovery/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for the well written IANA Considerations section. I have one comment
on it which should be easy to resolve:

The document doesn't seem to say anything about allowed characters in Metadata
names. When the document talks about "case-insensitive matching", it is not
clear how to implement the matching, because it is not clear whether or not
Metadata names are ASCII only. If they are not, then you need to better define
what "case insensitive" means.

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I am agreeing with Adam's DISCUSS.

---

From: Mike Jones <[email-masked]>
Date: Wed, 24 Jan 2018 22:11:43 +0000

Thanks for the useful review, Alexey.  I propose that we use the same character restrictions that are described in https://tools.ietf.org/html/rfc7638#section-6, which are:

   (a) require that member names being registered use
   only printable ASCII characters excluding double quote ('"') and
   backslash ('\') (the Unicode characters with code points U+0021,
   U+0023 through U+005B, and U+005D through U+007E), or

   (b) if new members are defined that use other code
   points, require that their definitions specify the exact Unicode code
   point sequences used to represent them.  Furthermore, proposed
   registrations that use Unicode code points that can only be
   represented in JSON strings as escaped characters must not be
   accepted.

I also propose that we say that member name comparison occurs in the manner described in https://tools.ietf.org/html/rfc7159#section-8.3.

Will that work for you, Alexey?

				Thanks,
				-- Mike

-----Original Message-----
From: Alexey Melnikov [mailto:[email-masked]] 
Sent: Wednesday, January 24, 2018 12:06 AM
To: The IESG <[email-masked]>
Cc: [email-masked]; Hannes Tschofenig <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Alexey Melnikov's Discuss on draft-ietf-oauth-discovery-08: (with DISCUSS and COMMENT)

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)

Thank you for the well written IANA Considerations section. I have one comment on it which should be easy to resolve:

The document doesn't seem to say anything about allowed characters in Metadata names. When the document talks about "case-insensitive matching", it is not clear how to implement the matching, because it is not clear whether or not Metadata names are ASCII only. If they are not, then you need to better define what "case insensitive" means.

---

From: Alexey Melnikov <[email-masked]>
Date: Sun, 28 Jan 2018 15:04:44 +0000

Hi Mike,

On Wed, Jan 24, 2018, at 10:11 PM, Mike Jones wrote:
> Thanks for the useful review, Alexey.  I propose that we use the same 
> character restrictions that are described in 
> https://tools.ietf.org/html/rfc7638#section-6, which are:
> 
>    U+0023 through U+005B, and U+005D through U+007E),

This looks reasonable.

> or

So just to double check: it is Ok to register names in Greek or Cyrillic (for example) and they will be compared in a case sensitive manner?

> I also propose that we say that member name comparison occurs in the 
> manner described in https://tools.ietf.org/html/rfc7159#section-8.3.

My understanding is that RFC 7159 recommends case-sensitive comparison and that is fine with me.

> Will that work for you, Alexey?

Best Regards,
Alexey
> Cc: [email-masked]; Hannes Tschofenig 
> <[email-masked]>; [email-masked]; 
> [email-masked]; [email-masked]
> Thank you for the well written IANA Considerations section. I have one 
> comment on it which should be easy to resolve:
> 
> The document doesn't seem to say anything about allowed characters in 
> Metadata names. When the document talks about "case-insensitive 
> matching", it is not clear how to implement the matching, because it is 
> not clear whether or not Metadata names are ASCII only. If they are not, 
> then you need to better define what "case insensitive" means.
> 
> 
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Mike Jones <[email-masked]>
Date: Sun, 28 Jan 2018 15:22:58 +0000

Your understanding matches with the intent of the language from RFC 7638. I'll plan to proceed on that basis then.

Thanks again,
-- Mike

From: Alexey Melnikov
Sent: Sunday, January 28, 7:04 AM
Subject: Re: [OAUTH-WG] Alexey Melnikov's Discuss on draft-ietf-oauth-discovery-08: (with DISCUSS and COMMENT)
To: Mike Jones, The IESG
Cc: [email-masked], [email-masked], [email-masked]

Hi Mike, On Wed, Jan 24, 2018, at 10:11 PM, Mike Jones wrote: > Thanks for the useful review, Alexey. I propose that we use the same > character restrictions that are described in > https://tools.ietf.org/html/rfc7638#section-6, which are: > > (a) require that member names being registered use > only printable ASCII characters excluding double quote ('"') and > backslash ('\') (the Unicode characters with code points U+0021, > U+0023 through U+005B, and U+005D through U+007E), This looks reasonable. > or > > (b) if new members are defined that use other code > points, require that their definitions specify the exact Unicode code > point sequences used to represent them. Furthermore, proposed > registrations that use Unicode code points that can only be > represented in JSON strings as escaped characters must not be > accepted. So just to double check: it is Ok to register names in Greek or Cyrillic (for example) and they will be compared in a case sensitive manner? > I also propose that we say that member name comparison occurs in the > manner described in https://tools.ietf.org/html/rfc7159#section-8.3. My understanding is that RFC 7159 recommends case-sensitive comparison and that is fine with me. > Will that work for you, Alexey? Best Regards, Alexey > > Thanks, > -- Mike > > -----Original Message----- > From: Alexey Melnikov [mailto:[email-masked]] > Sent: Wednesday, January 24, 2018 12:06 AM > To: The IESG > Cc: [email-masked]; Hannes Tschofenig > ; [email-masked]; > [email-masked]; [email-masked] > Subject: Alexey Melnikov's Discuss on draft-ietf-oauth-discovery-08: > (with DISCUSS and COMMENT) > > Alexey Melnikov has entered the following ballot position for > draft-ietf-oauth-discovery-08: Discuss > > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut this > introductory paragraph, however.) > > > Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. > > > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-oauth-discovery/ > > > > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- > > Thank you for the well written IANA Considerations section. I have one > comment on it which should be easy to resolve: > > The document doesn't seem to say anything about allowed characters in > Metadata names. When the document talks about "case-insensitive > matching", it is not clear how to implement the matching, because it is > not clear whether or not Metadata names are ASCII only. If they are not, > then you need to better define what "case insensitive" means. > > > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- > > I am agreeing with Adam's DISCUSS. > > > _______________________________________________ > OAuth mailing list > [email-masked] > https://www.ietf.org/mailman/listinfo/oauth