Draft: draft-ietf-ace-oauth-authz

Commentary: Looks good to me . I 'm merging this
Authorization is the process for granting approval to an entity to
access a resource RFC4949.  Managing authorization information for a
large number of devices and users is often a complex task where
dedicated servers are used.
Managing authorization of users, services and their devices with the
help of dedicated authorization servers (AS) is a common task, found
in enterprise networks as well as on the Web.  In its simplest form
the authorization task can be described as granting access to a
requesting client, for a resource hosted on a device, the resource
server (RS).  This exchange is mediated by one or multiple
authorization servers.
We envision that end consumers and enterprises will want to manage
access-control and authorization for their Internet of Things (IoT)
devices in the same style and this desire will increase with the
number of exposed services and capabilities provided by applications
hosted on the IoT devices.  The IoT devices may be constrained in
various ways including processing, memory, code-size, energy, etc.,
as defined in RFC7228, and the different IoT deployments present a
continuous range of device and network capabilities.  Taking energy
consumption as an example: At one end there are energy-harvesting or
battery powered devices which have a tight power budget, on the other
end there are devices connected to a continuous power supply which
are not constrained in terms of power, and all levels in between.
Thus IoT devices are very different in terms of available processing
and message exchange capabilities.
This memo describes a framework for authentication and authorization
in constrained environments (ACE) built on re-use of OAuth 2.0
RFC6749, thereby extending authorization to Internet of Things
devices with different kinds of constraints.  The framework
constitutes building blocks for adapting OAuth 2.0 to an IoT setting.
Detailed, interoperable deployments of this framework will be
described in ACE profiles, which MUST comply with this framework.
Implementations can claim conformance with a specific ACE profile,
where implementations of the same profile MUST be interoperable while
implementations of different profiles are not expected to be.
Powerful endpoints may support multiple profiles in order to be able
to interact with a variety of less powerful devices.
Authorization is the process for granting approval to an entity to
access a resource RFC4949.  The authorization task itself can best be
described as granting access to a requesting client, for a resource
hosted on a device, the resource server (RS).  This exchange is
mediated by one or multiple authorization servers (AS).  Managing
authorization for a large number of devices and users is a complex
task.
We envision that end consumers and enterprises will manage access to
resources on, or produced by, Internet of Things (IoT) devices in the
same style as they do today with data, services and applications on
the Web or with their mobile devices.  This desire will increase with
the number of exposed services and capabilities provided by
applications hosted on the IoT devices.
While prior work on authorization solutions for the Web and for the
mobile environment also applies to the IoT environment many IoT
devices are constrained, for example in terms of processing
capabilities, available memory, etc.
A detailed treatment of constraints can be found in RFC7228, and the
different IoT deployments present a continuous range of device and
network capabilities.  Taking energy consumption as an example: At
one end there are energy-harvesting or battery powered devices which
have a tight power budget, on the other end there are mains-powered
devices, and all levels in between.
Hence, IoT devices may be very different in terms of available
processing and message exchange capabilities and may support
different use cases RFC7744.
This memo describes a framework for authentication and authorization
in constrained environments (ACE) built on re-use of OAuth 2.0
RFC6749, thereby extending authorization to Internet of Things
devices.  This specification contains the necessary building blocks
for adjusting OAuth 2.0 to IoT environments.
More detailed, interoperable specifications can be found in profiles.
Implementations may claim conformance with a specific profile,
whereby implementations utilizing the same profile interoperate while
implementations of different profiles are not expected to be
interoperable.  Some devices, such as mobile phones and tablets, may
implement multiple profiles and will therefore be able to interact
with a wider range of low end devices.