<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Omri, if I understand correctly, you’ve got two main points here.<div><br></div><div>The first is that the doc is OAuth-centric. That’s true. I think Rifaat intended for this to serve as input to the bigger design patterns (PAD) doc – possibly to be slotted in where Alex and I had some comment threads in PAD saying “we really oughtta talk about OAuth a bit, since it’s so popular…”.<div><br></div><div>The second, separately, is that in addition to focusing on OAuth, it also provides a fair amount of authentication/IdP/etc. detail. There may be value in contextualizing readers’ authz expectations with these other components they’re familiar with. I think it might be best as an introductory topic, with detail that can mostly be elided in the authz patterns unless it makes an impact on the pro/con analysis.</div><div><br></div><div>Re the first point: As I just noted in Slack, I have a dream — to develop an abstract model for externalized authorization, using consensus-driven terminology, that can accelerate conversations about both P*P and OAuth, and all the other solutions in the space. :) To that end, I have revised my hand-drawn sketch to produce a second rev. I know this is still super rough, but if anyone shares my dream :), is it worth spending a few minutes on the call taking a look together? (I believe the boxes correspond roughly to the functionality already being proposed in the API doc and PDP-PEP doc.)</div><div><br></div><div><img alt="high-level authz model.png" src="cid:F7625609-CAB1-4925-B71F-3A465B26438B"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Dec 18, 2023, at 6:41 PM, Omri Gazitt via Openid-specs-authzen <openid-specs-authzen@lists.openid.net> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr">Thanks Rifaat... I added some of my comments. I may have misunderstood the purpose of the document, I took it to be a description of the authorization patterns we'd like to support / promote. If that's the intent, I feel like the current description is very OAuth / token-centric. Most of the implementations of authorization systems in the wild treat the authentication ceremony as upstream / out-of-scope, and assume the result of the authN ceremony is a signed access token that can be used to identify the subject.<div><br></div><div>The "AS" in OAuth2 is functionally a different component from the authorizer in externalized authorization architectures (at least the ones I know of).</div><div><br></div><div>If we want to describe the state of the world more accurately, I think we would make this clear in the document and its various scenarios.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Dec 18, 2023 at 1:13 PM Rifaat Shekh-Yusef via Openid-specs-authzen <<a href="mailto:openid-specs-authzen@lists.openid.net">openid-specs-authzen@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Resending the email, after it bounced back initially.</div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Dec 18, 2023 at 3:15 PM Rifaat Shekh-Yusef <<a href="mailto:rifaat.s.ietf@gmail.com" target="_blank">rifaat.s.ietf@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">All,<div><br></div><div>Eve and I have started working on the following document that describes the OAuth Authorization Patterns and various aspects of these patterns.</div><div><a href="https://docs.google.com/document/d/1UtkBdabXhNvps-29lhfldwGxMkv8OSwSE2zbAidEH_g/edit" target="_blank">OAuth Authorization Patterns - Google Docs</a><br></div><div><br></div><div>This is still a work in progress document, but we would like to share it with the WG and maybe discuss it tomorrow during our weekly meeting.</div><div><br></div><div>Please, take a look and let us know what you think. Feel free to add comments to the document.</div><div><br></div><div>Regards,</div><div> Rifaat</div><div><br></div></div>
</blockquote></div></div>
-- <br>
Openid-specs-authzen mailing list<br>
<a href="mailto:Openid-specs-authzen@lists.openid.net" target="_blank">Openid-specs-authzen@lists.openid.net</a><br>
<a href="https://lists.openid.net/mailman/listinfo/openid-specs-authzen" rel="noreferrer" target="_blank">https://lists.openid.net/mailman/listinfo/openid-specs-authzen</a><br>
</blockquote></div>
-- <br>Openid-specs-authzen mailing list<br>Openid-specs-authzen@lists.openid.net<br>https://lists.openid.net/mailman/listinfo/openid-specs-authzen<br></div></blockquote></div><br><div>
<meta charset="UTF-8"><div><br>Eve Maler | cell and Signal +1 425.345.6756</div>
</div>
<br></div></div></body></html>