Subject: [Ace] draft-bormann-core-ace-aif-00

From: "Hannes Tschofenig" <[email-masked]>
Date: Mon, 24 Feb 2014 12:20:32 +0100

Hi Carsten,

thanks for creating draft-bormann-core-ace-aif-00.

Reading through the document I was wondering whether you have compared the functionality with other authorization system to see what the similarities and the differences are.

It appears to me that while your proposal is simple it does not cover the basic requirements in the use case document.

The model with the URI "local-part" seems attractive but assumes that there is some "agreement" between the authorization server and the resource server about the semantic of those. Do you expect that those "local URI parts" are standardized somehow?

Ciao

Hannes

PS: As an example of an alternative design please have a look at the Facebook permission API: https://developers.facebook.com/docs/facebook-login/permissions

Instead of using URIs it uses symbolic names, which may cluster several resources together.