Web Authorization Protocol (oauth)
----------------------------------

 Charter
 Last Modified: 2011-06-14

 Current Status: Active Working Group

 Chair(s):
     Blaine Cook  <romeda@gmail.com>
     Hannes Tschofenig  <Hannes.Tschofenig@gmx.net>
     Barry Leiba  <barryleiba@computer.org>

 Security Area Director(s):
     Stephen Farrell  <stephen.farrell@cs.tcd.ie>
     Sean Turner  <turners@ieca.com>

 Security Area Advisor:
     Stephen Farrell  <stephen.farrell@cs.tcd.ie>

 Technical Advisor(s):
     Peter Saint-Andre  <stpeter@stpeter.im>

 Mailing Lists: 
     General Discussion:oauth@ietf.org
     To Subscribe:      https://www.ietf.org/mailman/listinfo/oauth
     Archive:           http://www.ietf.org/mail-archive/web/oauth/current/maillist.html

Description of Working Group:

The Web Authorization (OAuth) protocol allows a user to grant
a third-party Web site or application access to the user's protected
resources, without necessarily revealing their long-term credentials,
or even their identity. For example, a photo-sharing site that supports
OAuth could allow its users to use a third-party printing Web site to
print their private pictures, without allowing the printing site to
gain full control of the user's account.

OAuth encompasses
* a mechanism for a user to authorize issuance of credentials that
 a third party can use to access resources on the user's behalf and
* a mechanism for using the issued credentials to authenticate
 HTTP requests.

In April 2010 the OAuth 1.0 specification, documenting pre-IETF work,
was published as an informational document (RFC 5849). The working
group has since been developing OAuth 2.0, a standards-track version
that will reflect IETF consensus.  Version 2.0 will consider the
implementation experience with version 1.0, a discovered security
vulnerability (session fixation attack), the use cases and
functionality proposed with OAuth WRAP [draft-hardt-oauth-01] and will
* improve the terminology used,
* consider broader use cases,
* embody good security practices,
* improve interoperability, and
* provide guidelines for extensibility.

The working group will develop authentication schemes for
peers/servers taking part in OAuth (accessing protected resources).
This includes

* an HMAC-based authentication mechanism

This document aims to provide a general purpose MAC authentication
scheme that can be used both with OAuth 2.0 but also with other use cases.
The WG will work with the security and applications area directors to
ensure that this work gets appropriate review, e.g. via additional last
calls in other relevant working groups such as HTTPBIS,

* a specification for access protected by Transport Layer Security
(bearer tokens),

* an extension to OAuth 2.0 to allow access tokens to be requested
when a client is in possession of a SAML assertion.

A separate informational description will be produced to provide
additional security analysis for audiences beyond the community
of protocol implementers.

Milestones will be added for the later items after the near-term work
has been completed.
 Goals and Milestones:

   Done         Submit 'OAuth 2.0 Threat Model and Security Considerations' as 
                a working group item 

   Done         Submit 'HTTP Authentication: MAC Authentication' as a working 
                group item 

   Jul 2011       Submit 'The OAuth 2.0 Protocol: Bearer Tokens' to the IESG for 
                consideration as a Proposed Standard 

   Jul 2011       Submit 'The OAuth 2.0 Authorization Protocol' to the IESG for 
                consideration as a Proposed Standard 

   Aug 2011       Submit 'HTTP Authentication: MAC Authentication' to the IESG 
                for consideration as a Proposed Standard 

   Oct 2011       Submit 'SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 
                2.0' to the IESG for consideration as a Proposed Standard 

   Oct 2011       Re-chartering working group 


 Internet-Drafts:

Posted Revised         I-D Title   <Filename>
------ ------- --------------------------------------------
Apr 2010 Jul 2011   <draft-ietf-oauth-v2-19.txt>
                The OAuth 2.0 Authorization Protocol 

Dec 2010 Jun 2011   <draft-ietf-oauth-v2-bearer-06.txt>
                The OAuth 2.0 Protocol: Bearer Tokens 

Jan 2011 May 2011   <draft-ietf-oauth-saml2-bearer-04.txt>
                SAML 2.0 Bearer Assertion Grant Type Profile for OAuth 2.0 

May 2011 May 2011   <draft-ietf-oauth-v2-http-mac-00.txt>
                HTTP Authentication: MAC Access Authentication 

Jul 2011 Jul 2011   <draft-ietf-oauth-v2-threatmodel-00.txt>
                OAuth 2.0 Threat Model and Security Considerations 

Jul 2011 Jul 2011   <draft-ietf-oauth-assertions-00.txt>
                OAuth 2.0 Assertion Profile 

 Request For Comments:

  None to date.