hlflanagan / fedidcg Goto Github PK

First line of 'Scope of Work' should read:

Federated authentication--the outsourcing of authentication to another origin--

(Emphasis added for clarity)

Looks good to me!

Please correct "OAuth2.0" to "OAuth 2.0" and "OIDC" to "OpenID Connect".

OAuth and its IETF WG are mentioned a number of times but the "Scope of Work" talks only about federated authentication. It's a bit of a semantic rathole and I'd be lying if I claimed to have more than a clue about the right terminology but what OAuth does seems different enough that it likely warrants some kind of distinct mention in the scope. Maybe something like delegated authorization or federated authorization?

In "Proposals begin as or evolve into explainers which describe a user-facing problem which needs to be solved and how the authors propose to solve it.", please correct both instances of "which" to "that".

Seems odd to have a charter that deals with authentication and not have a coordination with the the WebAuthn WG, as this is the only W3C WG dealing with secure authentication, suggest you add the WebAuthn WG especially if this WG takes up roaming type (cloud based) authentication,

OpenID Connect was listed but it maybe worth calling out OpenID Connect Federation 1.0 specifically

There are a couple times prospective stakeholders are listed -- i.e., "needs of the user, the developer, and the identity provider" and "to enable interoperability between user agents, developers, and identity providers." -- that seem to omit the relying party. Maybe developer was meant to encompass the RP? I dunno but user agents, IDPs and SPs all have developers. Relying parties are fundamental to federated authentication and need to be given first class consideration.

* The t-shirt that inspired the issue title: https://www.flickr.com/photos/brian-d-campbell/51278659993