[core] Question about RD from ACE

[Ludwig Seitz]

Hello CoRE,

an interesting question has come up in ACE, for which we would need
feed-back from people familiar with the Resource Directory work.

In our draft we suggest that a client that whishes to access a resource
at a server can look up the authorization server in charge of that
server in a resource directory [1]. Jim Schaad has made me aware that
this is not as easy as it sounds [2], and I feel I would need feed-back
as to:

1.) Is it a good idea at all to put such information somewhere in the RD?

2.) Where in the RD would one put such information? What would such a
resource type look like?


Regards,

Ludwig Seitz

[1] https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-08#section-5.1
[2] https://github.com/ace-wg/ace-oauth/issues/120

[Carsten Bormann]

Post by Ludwig Seitz
Hello CoRE,
an interesting question has come up in ACE, for which we would need feed-back from people familiar with the Resource Directory work.
In our draft we suggest that a client that whishes to access a resource at a server can look up the authorization server in charge of that server in a resource directory [1].

That appears to be the wrong way around.

A client that finds a resource in a resource directory might find link relations or target attributes there that will also find the authorization manager for that server.

Post by Ludwig Seitz
1.) Is it a good idea at all to put such information somewhere in the RD?

Yes. We haven’t really discussed how the authorization of the disclosure of such information would work in an RD, but that should be a relatively small step with ACE available.

Post by Ludwig Seitz
2.) Where in the RD would one put such information? What would such a resource type look like?

Say,

<coaps://security.example.com/as>;rel=authorization-managed-by;anchor=“/s/temp”;ace-profile=“oscore"

(Add target attributes to get more useful profile information in there; the above surely doesn’t cut it.)

Grüße, Carsten