Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates to Security Metadata Proposal #88

Merged
merged 11 commits into from
Apr 25, 2018
Merged

Conversation

mmccool
Copy link
Contributor

@mmccool mmccool commented Apr 9, 2018

  • Allow name:value pairs for security configurations, enabled by JSON-LD 1.1 frames
  • Convert as -> authorizationUrl, ts -> tokenUrl, and rs -> refreshUrl. The shorter names are nicer but "rs" has a conflict with "Resource Server" that it is best to avoid, and these names are consistent with OpenAPI.

@mmccool mmccool changed the title JSON-LD 1.1 syntax and auth-server key tweak Post-Prague Updates Apr 9, 2018
@mmccool
Copy link
Contributor Author

mmccool commented Apr 13, 2018

  • update examples to more closely follow new name:value style for interactions with separate property/action/event sections in TDs rather than using a single array and @type values
  • show use of "definitions" section to group security configurations
  • formatting cleanup and minor tweaks to text

@mmccool
Copy link
Contributor Author

mmccool commented Apr 13, 2018

Still need to fix certain things in the examples; waiting for updates to main TD examples.

@mmccool mmccool changed the title Post-Prague Updates Updates to Security Metadata Proposal Apr 19, 2018
Add references to RFC's 7235 (HTTP/1.1 authentication), 7615 (Authentication-Info and Proxy-Authentication-Info headers), and 7616 (Digest authentication)
Add (incomplete) description of digest scheme.   Add list of omitted schemes: oauth, mutual, hoba.
also some formatting fixes
Remove securityDefinitions block in second example; fix formatting issues; add a bit clearer explanation of definitions.
@mmccool
Copy link
Contributor Author

mmccool commented Apr 23, 2018

Ready for another round of reviews, and I'd like to do a merge. There are some significant changes from the first version; I just added a separate "securityDefinitions" block and made other changes that make this version of the proposal consistent with and backward compatible with the current TD spec.

Copy link
Contributor

@ereshetova ereshetova left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is really now in shape for merging to the working branch as proposal. It should be much easier for people to see and find it this way.

@mmccool mmccool merged commit 07353d4 into w3c:working Apr 25, 2018
@sebastiankb
Copy link

I just started to include the security terms in the TD code model. I wonder if the term "scheme" is somehow redundant, if we also have the name of the scheme (e.g., 'apikey', 'basic') as part of the key name as in apikeyConfig, basicConfig etc?
If the term scheme is really required I would propose to define a super class 'securityConfig' that contains common used config terms. So far this would make sense for 'scheme' and 'in', right?

@mmccool
Copy link
Contributor Author

mmccool commented Apr 28, 2018

Under the revised proposal a configuration can be given without any key (tag). Also, in general there could be more than one config using the same scheme. So yes, I think we need “scheme”. I agree it DOES seem a little redundant but under the revised proposal keys (named configurations) are only used in securityDefinitions which can be considered an optional “convenience” feature (and only important in very complex configurations).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants