Subject: [OAUTH-WG] [oauth] #4: Error Codes

From: "oauth issue tracker" <[email-masked]>
Date: Tue, 21 Jul 2009 22:35:46 -0000

#4: Error Codes
---------------------------------+------------------------------------------
 Reporter:  [email-masked]  |       Owner:     
     Type:  defect               |      Status:  new
 Priority:  critical             |   Milestone:     
Component:  authentication       |     Version:     
 Severity:  Active WG Document   |    Keywords:     
---------------------------------+------------------------------------------
 Section 8 poorly defines the HTTP response status codes (400 and 401), and
 does not provide for any mechanism to convey the actual protocol errors
 preventing the client from successfully authenticating.

 A proposed 'problem reporting' extension has been proposed for the Core
 1.0 protocol:

 http://wiki.oauth.net/ProblemReporting

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/oauth/trac/ticket/4>
oauth <http://tools.ietf.org/oauth/>

---

From: Ethan Jewett <[email-masked]>
Date: Fri, 31 Jul 2009 13:16:30 -0400

Is the proposal to consider including the basic approach of the problem
reporting extension linked below into the authentication portion of the
spec? I think this would be a good approach.
I think it would also be beneficial to consider including similar (or
preferably the same) error reporting functionality in the web-delegation
portion of the spec, since post-rev1.0a oauth requires signing of the token
requests and signing is where implementors and library authors seem to run
into a lot of problems.

Perhaps this issue should be categorized under both components?

Ethan

---

From: Eran Hammer-Lahav <[email-masked]>
Date: Fri, 31 Jul 2009 10:27:47 -0700

I think if you solve it in the authentication part, the delegation parts simply inherits it. However, it might need to extend it with some delegation specific codes.

The main problem with the problem reporting extension today is that it is too rich and complex without adding value.

EHL

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ethan Jewett
Sent: Friday, July 31, 2009 10:17 AM
To: [email-masked]
Subject: Re: [OAUTH-WG] [oauth] #4: Error Codes

Is the proposal to consider including the basic approach of the problem reporting extension linked below into the authentication portion of the spec? I think this would be a good approach.

I think it would also be beneficial to consider including similar (or preferably the same) error reporting functionality in the web-delegation portion of the spec, since post-rev1.0a oauth requires signing of the token requests and signing is where implementors and library authors seem to run into a lot of problems.

Ethan

On Tue, Jul 21, 2009 at 6:35 PM, oauth issue tracker <[email-masked]<mailto:[email-masked]>> wrote:
#4: Error Codes
---------------------------------+------------------------------------------
 Reporter:  [email-masked]<mailto:[email-masked]>  |       Owner: