Draft: draft-ietf-gnap-core-protocol

Commentary: Read through the full spec ( which is a fairly pleasant read , actually ) to try to fix any outstanding editorial issue before next step 
 Built To edit notification comments on pull requests , go to your . _ 
 Maybe also we can change " The client instance establishes a verifiable session to the user , in the role of the end user . " ( section 1.6.2 ) . Verifiable is n't very clear .
Paragraph (version A):
This protocol allows a piece of software, the client instance, to
request delegated authorization to resource servers and to request
direct information.  This delegation is facilitated by an
authorization server usually on behalf of a resource owner.  The end
user operating the software may interact with the authorization
server to authenticate, provide consent, and authorize the request.
Paragraph (version B):
This protocol allows a piece of software, the client instance, to
request delegated authorization to resource servers and to request
direct subject information.  This delegation is facilitated by an
authorization server usually on behalf of a resource owner.  The end
user operating the software may interact with the authorization
server to authenticate, provide consent, and authorize the request.
Paragraph (version A):
In this example flow, the client instance is a device that is capable
of presenting a short, human-readable code to the user and directing
the user to enter that code at a known URI.  The URI the user enters
the code at is an interactive service hosted by the AS in this
example.  The client instance is not capable of presenting an
arbitrary URI to the user, nor is it capable of accepting incoming
HTTP requests from the user's browser.  The client instance polls the
AS while it is waiting for the RO to authorize the request.  The
user's interaction is assumed to occur on a secondary device.  In
this example it is assumed that the user is both the end user and RO,
though the user is not assumed to be interacting with the client
instance through the same web browser used for interaction at the AS.
Paragraph (version B):
In this example flow, the client instance is a device that is capable
of presenting a short, human-readable code to the user and directing
the user to enter that code at a known URI.  The user enters the code
at a URI that is an interactive service hosted by the AS in this
example.  The client instance is not capable of presenting an
arbitrary URI to the user, nor is it capable of accepting incoming
HTTP requests from the user's browser.  The client instance polls the
AS while it is waiting for the RO to authorize the request.  The
user's interaction is assumed to occur on a secondary device.  In
this example it is assumed that the user is both the end user and RO,
though the user is not assumed to be interacting with the client
instance through the same web browser used for interaction at the AS.
Paragraph (version A):
If access is approved, the resulting access token is valid for the
described resource and is bound to the client instance's key (or its
most recent rotation).  The token is labeled "token1-23".  The token
response structure is described in response-token-single.
Paragraph (version B):
If access is approved, the resulting access token is valid for the
described resource and, since no flag is provided in this example, is
bound to the client instance's key (or its most recent rotation).
The token is labeled "token1-23".  The token response structure is
described in response-token-single.
Paragraph (version A):
Subject identifiers are hints to the AS in determining the RO and
MUST NOT be taken as declarative statements that a particular RO is
present at the client instance and acting as the end user.
Assertions SHOULD be validated by the AS.
Paragraph (version B):
Subject identifiers are hints to the AS in determining the RO and
MUST NOT be taken as authoritative statements that a particular RO is
present at the client instance and acting as the end user.
Assertions SHOULD be validated by the AS.
Paragraph (version A):
For example, the "sha-256" hash method consists of hashing the input
string with the 256-bit SHA2 algorithm.  The byte array is then
encoded using URL-Safe Base64 with no padding RFC4648.  The resulting
string is the hash value.
Paragraph (version B):
The "sha-256" hash method consists of hashing the input string with
the 256-bit SHA2 algorithm.  The byte array is then encoded using
URL-Safe Base64 with no padding RFC4648.  The resulting string is the
hash value.
Paragraph (version A):
When used for delegation in GNAP, these key binding mechanisms allow
the AS to ensure that the keys presented by the client instance in
the initial request are in control of the party calling any follow-up
or continuation requests.  To facilitate this requirement, the
response-continue includes an access token bound to the request-
client, and that key (or its most recent rotation) MUST be proved in
all continuation requests continue-request.  Token management
requests token-management are similarly bound to either the access
token's own key or, in the case of bearer tokens, the client
instance's key.
Paragraph (version B):
When used for delegation in GNAP, these key binding mechanisms allow
the AS to ensure that the keys presented by the client instance in
the initial request are in control of the party calling any follow-up
or continuation requests.  To facilitate this requirement, the
response-continue includes an access token bound to the request-
client, and that key (or its most recent rotation) MUST be proved in
all continuation requests continue-request.  Token management
requests (token-management) are similarly bound to either the access
token's own key or, in the case of bearer tokens, the client
instance's key.
Paragraph (version A):
If this request is approved, the response-token-single's access
rights will be the union of the requested types of access for each of
the two APIs, just as above.
Paragraph (version B):
If this request is approved, the resulting access token's access
rights will be the union of the requested types of access for each of
the two APIs, just as above.