...
- WG telecon on Thursday, 16 Feb 2012, at 9am PT (time chart)
- Skype: +99051000000481
- US: +1-805-309-2350 (other international dial-in lines available) | Room Code: 178-2540
Agenda
- Roll call
- Approve minutes of 2012-02-09 meeting
- Interop planning and implementation discussion
- Review open action items
- KI.org UMA blog post planning: nutshell? interop? open source?...
- Work through issues
- Is client_credentials the right grant-type choice for multiple requester tokens? (email)
- JSONified config data okay? (edits from last week)
- Conformance flag around policy handling? (Gerry B discussion)
- 31 (baskets)
- 41 (JSON media types)
- 7 (caching language)
- ...
- AOB
...
Action item number | Assigned To | Status | Description | Comments |
|---|---|---|---|---|
Various | Ongoing | Build list of FAQs on the wiki. | Paul to write a FAQ on "access granularity". Susan to draft a FAQ on "government PDS use cases". Dom to translate entries into Italian. Eve to link to Cordny's UMA article in Dutch from FAQ. | |
Frank, Sal, Dom, Sus, Kevin et al. | Open | Prepare Trust Model "user guide". | In progress. Let's try and prepare something lightweight for the interop wiki. | |
Dom, Eve, Maciej | Open | Work on interop wiki area and early-March blog post. |
|
Roll call
Quorum was reached.
Approve minutes of 2012-02-09 meeting
Minutes of 2012-02-09 meeting APPROVED.
Interop planning and implementation discussion
Domenico, Maciej, and Eve will follow up on interop wiki content. Eve will send mail to the list with her starter thoughts.
Review open action items
Domenico agrees to start translating the first FAQ or two into Italian.
...
Let's target early March for a post advertising the interop.
Work through issues
- 49 (client_credentials)
What are implementations doing today? If Alice and Bob both use CopMonkey for protecting resources, how does a single requester get a unique token at CopMonkey for each authorizing user? Currently, the SMART implementation isn't using the client_credentials flow for requesters getting tokens; it's using the authorization_code flow, so that the tokens it gets are, at a minimum, unique to the requesting party/requester/AM. But it's not unique to the host, nor to the authorizing user (unless the authorizing user and requesting party are the same). So, at a minimum, our requirement to use the client_credentials flow isn't helpful.
...