Hello all-- Please respond to these email threads before Monday's ad hoc if you can! https://github.com/KantaraInitiative/wg-uma/issues/273 Please see below for the notes from today, and weigh in. ====
From UMA telecon 2017-03-02 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-03-02>: There is a shallow way to treat this issue, and a deep way, and maybe a medium way.
1. A shallow way is s/user/resource owner/. This gets rid of the jarring impact of seeing "user", considering that Mike has implemented RReg for an OAuth-based API protection use case (as in the first bullet of the RReg Intro), using the client credentials grant. 2. Another shallow way (in addition to #1 <https://github.com/KantaraInitiative/wg-uma/issues/1>, presumably) might be to require OAuth for protecting the RReg endpoint, which requires providing a resource owner context. 3. The deep way might be something like absorbing the entire RReg spec into the UMA Core spec, if we think it's truly incompatible with OAuth and OpenID Connect use cases generally. 4. A medium way might be refactoring the RReg spec to draw the dividing line in a different place, such as having RReg merely provide the bare bones of the API, and having Core provide extension properties to do all the "policy-setting-relevant" work, such as the name, icon_uri, and description fields. This would lengthen Core kind of significantly, but keep an interesting RReg module. Eve and Mike aren't crazy about #4 because it's invasive and really lengthens Core, and it isn't proven yet that RReg as it stands isn't relevant to all three of the technologies or others yet to come. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl