Subject: [OAUTH-WG] treatment of client_id in extension grant_types?

From: Brian Campbell <[email-masked]>
Date: Wed, 25 May 2011 15:12:09 -0600

Currently (draft -16) client_id is listed as a required parameter for
access token request to the token endpoint for all grant types except
for extensions.  In section 3 there is some disposition of the use of
client_id as a means of identification and then, in 3.2, a requirement
that client authentication mechanisms must "define a mapping between
the client identifier and the credentials used to authenticate."

Does this imply that, if client authentication is done at the token
endpoint for any extension grant, that the client_id parameter is also
required? If so, perhaps it could be made more explicit somewhere in
section 3 or section 5. I remember that there was some consensus a
while back that client identification/authentication should be
optional for the extensions, and that makes sense.  But when
authentication is done, it seems like it should be consistent with the
way the other grants do it - that allows for implementations to have a
cleaner separation between client authentication and grant processing.

---

From: Igor Faynberg <[email-masked]>
Date: Wed, 25 May 2011 18:39:44 -0400

Brian Campbell wrote:
> required? 
This is the only way I would interpret that.

> If so, perhaps it could be made more explicit somewhere in
+1!

To piggy-back, I remember a query from Peter on the definition of 
client_id (or rather absence of it), and Brian's response, and then 
another note form Peter on character choice. What is the follow-up 
plan?  It looks to me like something that absolutely ought to be fixed 
in 2.0.

Igor
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth
>