Step Up from Lighthearted Joke to RFC Homage

There’s a note thanking “the shampoo manufacturers” right at the top of the acknowledgements section of the RFC-to-be 9470 draft. Originally it was merely a placeholder and lighthearted joke that I fully expected would be removed before final publication. But as the document moved into the last editorial phase of the publication process, I was preparing myself for a fight with the editors to keep it in. It had become more than a joke to me - it was now an homage to my friend and co-author of the document. The fight never materialized. But anticipating it gave me a place to channel my sadness and anger.

Vittorio Bertocci is known for many things. For his innumerable contributions to the identity industry, of course, but also for his heavy Italian accent and luxurious long flowing hair. The note thanking the shampoo manufacturers was simply a jest about his iconic hair. Sadly, however, Vittorio was recently diagnosed with pancreatic cancer and, in anticipation of treatment, had to cut off all that luxurious hair. He had to let go of his hair. I can’t let go of the joke. It’s my small tribute to him and way of saying “f*#k you” to cancer.  

I recall a time, early in my identity career, when I was struggling to understand some fundamental concept (I think it was about WS-* but the specifics are unimportant now). I just couldn’t wrap my head around it. It wasn’t until someone pointed me to a short video of Vittorio explaining the topic that it finally clicked for me. This was my first encounter with him and, while I don’t remember the details, I do remember being deeply appreciative for being given the feeling of comprehending. My experience isn’t unique, however, Vittorio has a unique ability and willingness to share his vast knowledge in an accessible way, whether through his public appearances or the one-on-one interactions he graciously offers. I have no doubt the adulation and regard he’s garnered is due as much to individual impact on people as the broad industry contributions. 

In the years since I’ve been lucky enough to get to know Vittorio and work on some things together. Even though we’ve always been employed by competitors, we’ve had the opportunity to collaborate on work for the (hopefully anyway) greater good of the identity industry. Most recently we co-authored the aforementioned RFC 9470 - “OAuth 2.0 Step Up Authentication Challenge Protocol.”

The specification provides an interoperable way for a protected resource to tell an OAuth client when the user authentication with which the given access token was obtained is insufficient in strength or recentness. The requirements for user authentication are expressed in the challenge to the client that, in turn, can use that information to influence a subsequent authentication ceremony with the authorization server to obtain a new access token sufficient for access. It’s a relatively simple specification that pragmatically fills a longstanding gap in the OAuth world.

I could not have had a better co-author for the work and to say it was an honor and privilege would be an understatement. Although an RFC is pretty insignificant in the larger scheme of things, it will hopefully prove useful to the community, and getting it published in the face of Vittorio’s recent diagnosis has taken on a newfound significance for me.  

I'm honestly at a loss for words to adequately express my deep appreciation and respect for Vittorio. Instead, I hope that the lighthearted little joke in the RFC bearing both our names will somehow convey that which I am unable to articulate.