Subject: [OAUTH-WG] [oauth] #3: Discovery Outline / Boundries

From: "oauth issue tracker" <[email-masked]>
Date: Tue, 21 Jul 2009 22:31:28 -0000

#3: Discovery Outline / Boundries
---------------------------------+------------------------------------------
 Reporter:  [email-masked]  |       Owner:     
     Type:  task                 |      Status:  new
 Priority:  major                |   Milestone:     
Component:  web-delegation       |     Version:     
 Severity:  Active WG Document   |    Keywords:     
---------------------------------+------------------------------------------
 The delegation workflow includes two HTTP requests (sections 4 and 6) but
 only recommends the use of POST. It defines three endpoints (sections 4,
 5, and 6) but their URI is identified manually.

 This pose a significant interoperability issue without a complementary
 discovery mechanism (which is currently out of scope). A client receiving
 a 401 has no way of interacting with an unknown client.

 The WG has to decide how much should be left for a separate discovery
 specification and how much should be made mandatory in the current
 specification.

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/oauth/trac/ticket/3>
oauth <http://tools.ietf.org/oauth/>

---

From: "oauth issue tracker" <[email-masked]>
Date: Fri, 31 Jul 2009 17:34:52 -0000

Severity:  Active WG Document   |   Resolution:     
 Keywords:                       |  

Comment(by [email-masked]):

 Barring other concerns, it seems that it would be helpful to define at
 least optional parameters in the response to the get_request_token request
 that fully define the request_auth and get_token URLs. Would this be a
 problem in any scenarios?

 I don't see the way to discovery of the initial get_request_token URL
 without a more full-featured discovery mechanism, which I guess is out of
 scope, but also seems somewhat unnecessary. Possibly we could define a
 parameter in whatever problem reporting approach we decide to adopt in
 response to https://trac.tools.ietf.org/wg/oauth/trac/ticket/4 that would
 provide the get_request_token URL to the client.

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/oauth/trac/ticket/3#comment:1>
oauth <http://tools.ietf.org/oauth/>

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 31 Jul 2009 10:45:13 -0700

(I think it would be best to use the list for discussing this issues, and not the issue tracker system...)

EHL

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of oauth issue tracker
> Sent: Friday, July 31, 2009 10:35 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [OAUTH-WG] [oauth] #3: Discovery Outline / Boundries
> 
> Ticket URL:
> <https://trac.tools.ietf.org/wg/oauth/trac/ticket/3#comment:1>
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth