absorbing the auth framework from 2617

[julian.reschke@…]

This issue is opened to track the process of absorbing "everything except Basic and Digest" from RFC 2617.

To do

• add all the RFC 2617 authors to P7 (?)
• add Section 1.2, plus a subset of the security considerations (Section 4)
• apply erratum ​http://www.rfc-editor.org/errata_search.php?eid=1959

[julian.reschke@…]

Excerpt from ​http://www.ietf.org/proceedings/78/minutes/httpbis.txt:

 4. RFC2617
mnot: part7 is the http auth framework, the meat of auth (basic and digest) is in 2617
issues like i18n auth scheme registry might be addressed
a path could be to have basic and digest in one or two drafts, framework in p7
Alexey: seems to be the right thing to do, having the framework in p7 is fine, other two documents will need a recharter
mnot: no changes needed as a first step to produce new documents, only i18n will require changes
Alexey: reopening digest could be controversial
<Barry Leiba> Cyrus: I don't see that draft-ietf-vwrap-type-system <http://tools.ietf.org/wg/vwrap/draft-ietf-vwrap-type-system/> has any ref to RFC 2617.  Checking whether I got the right doc when you said that.
<Barry Leiba> Never mind... 2817, not 2617.
mnot: if the recharter says that only editorial changes are made, it could help.
Cyrus: not sure IESG will accept Digest as-is
Alexey: moving to historic might help. If somebody want to reopen Basic and Digest, it would be better if it was in a WG
Cyrus: Mutual Auth is there as an example of new auth
mnot: we are not a security-related WG
<roy.fielding> How about defining a registry for auth schemes?
Alexey: that is a good idea (in response to Roy's comment)

[julian.reschke@…]

proposed patch for part 7 (missing: potentially additional authors, change information wrt 2617?)

[julian.reschke@…]

From [998]:

Incorporate auth framework from RFC 2617; ack RFC 2617's authors, fix known auth-param erratum (see #195)(see #237)

[julian.reschke@…]

From [1007]:

s/canonical root URL/canonical root URI/ and fix whitespace (related to #237)

[julian.reschke@…]

From [1018]:

move and rephrase Note about listing well-known schemes first in WWW-Authenticate (see #237)